CVE-2026-25449
Awaiting Analysis Awaiting Analysis - Queue
Deserialization Object Injection in Shinetheme Traveler

Publication date: 2026-03-18

Last updated on: 2026-04-23

Assigner: Patchstack

Description
Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-18
Last Modified
2026-04-23
Generated
2026-06-16
AI Q&A
2026-03-18
EPSS Evaluated
2026-06-15
NVD
CVE-2026-25449
EUVD
EUVD-2026-12821
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
shinetheme traveler From 3.2.8.1 (inc) to 3.2.8.1 (exc)
shinetheme traveler to 3.2.8.1 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

I don't know

Executive Summary

CVE-2026-25449 is a high-severity PHP Object Injection vulnerability found in the WordPress Traveler Theme versions prior to 3.2.8.1.

This vulnerability allows unauthenticated attackers to inject malicious objects into the application, potentially leading to arbitrary code execution, SQL injection, path traversal, denial of service, and other attacks if a suitable PHP Object Injection Property Oriented Programming (POP) chain is present.

It is classified under the OWASP Top 10 category A3: Injection and has a critical CVSS score of 9.8.

Impact Analysis

This vulnerability can have severe impacts including allowing attackers to execute arbitrary code on your system, perform SQL injection attacks, traverse paths to access unauthorized files, and cause denial of service conditions.

Because the vulnerability can be exploited without authentication, it poses a significant risk to any website using the affected Traveler Theme versions.

Exploitation could lead to complete compromise of the affected website, data breaches, service outages, and other security incidents.

Mitigation Strategies

The immediate mitigation step is to update the WordPress Traveler Theme to version 3.2.8.1 or later, which contains the patch for this vulnerability.

If you are unable to update immediately, Patchstack provides an automatic mitigation rule to block attacks targeting this vulnerability until the update can be applied.

Users who cannot update right away are advised to seek assistance from their hosting provider or web developer to apply temporary protections.

Detection Guidance

I don't know

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-25449. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart