CVE-2026-23542
Deserialization Object Injection in Grand Restaurant Plugin
Publication date: 2026-02-19
Last updated on: 2026-02-19
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| themegoods | grand_restaurant | to 7.0.10 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-23542 is a high-priority PHP Object Injection vulnerability found in the WordPress Grand Restaurant Theme versions up to and including 7.0.10.
This vulnerability allows unauthenticated attackers to inject malicious PHP objects, which can lead to various harmful actions such as code injection, SQL injection, path traversal, and denial of service.
The issue arises from deserialization of untrusted data, enabling attackers to exploit the theme if a suitable PHP Object Injection POP chain is available.
How can this vulnerability impact me? :
This vulnerability can have severe impacts including allowing attackers to execute arbitrary code on your server, manipulate or access your database through SQL injection, traverse directories to access unauthorized files, and cause denial of service conditions.
Because the vulnerability can be exploited by unauthenticated attackers, it poses a significant risk to the security and availability of websites using the affected theme.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
[{'type': 'paragraph', 'content': 'This vulnerability is a PHP Object Injection issue affecting the WordPress Grand Restaurant Theme up to version 7.0.10. Detection typically involves monitoring for exploitation attempts such as unusual HTTP requests that may include serialized PHP objects or payloads attempting code injection, SQL injection, or path traversal.'}, {'type': 'paragraph', 'content': 'While no specific detection commands are provided, administrators can use web server logs and intrusion detection systems to look for suspicious POST or GET requests containing serialized PHP objects or unusual parameters targeting the theme.'}, {'type': 'paragraph', 'content': "Additionally, applying Patchstack's mitigation rule can help detect and block attack attempts targeting this vulnerability."}] [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate and recommended mitigation step is to update the WordPress Grand Restaurant Theme to version 7.0.11 or later, where this vulnerability has been patched.
Until the update can be applied, it is advised to implement the mitigation rule provided by Patchstack to block attacks targeting this vulnerability, providing rapid protection for affected websites.