CVE-2026-28074
Received Received - Intake
Deserialization Vulnerability in Pizza House Plugin Enables Object Injection

Publication date: 2026-03-05

Last updated on: 2026-03-05

Assigner: Patchstack

Description
Deserialization of Untrusted Data vulnerability in ThemeREX Pizza House pizzahouse allows Object Injection.This issue affects Pizza House: from n/a through <= 1.4.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-05
Last Modified
2026-03-05
Generated
2026-06-16
AI Q&A
2026-03-05
EPSS Evaluated
2026-06-15
NVD
CVE-2026-28074
EUVD
EUVD-2026-9732
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
themerex pizzahouse to 1.4.0 (inc)
themerex pizza_house to 1.4.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

CVE-2026-28074 is a high-severity PHP Object Injection vulnerability affecting the WordPress Pizza House Theme versions up to and including 1.4.0.

This vulnerability allows unauthenticated attackers to perform PHP Object Injection, which is classified under OWASP Top 10 A3: Injection.

If a suitable Property Oriented Programming (POP) chain is available, attackers can exploit this flaw to perform code injection, SQL injection, path traversal, denial of service, and other attacks.

Impact Analysis

This vulnerability can have critical impacts including unauthorized code execution, data breaches through SQL injection, unauthorized file access via path traversal, and service disruption through denial of service attacks.

Because the vulnerability can be exploited by unauthenticated attackers, it poses a high risk to the security and availability of affected websites using the Pizza House Theme.

The CVSS score of 9.8 indicates a critical risk with a high likelihood of exploitation.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

This vulnerability affects the WordPress Pizza House Theme versions up to and including 1.4.0 and allows PHP Object Injection attacks.

No official patch is currently available for this vulnerability.

Patchstack has released a mitigation rule that can be applied to block attacks targeting this flaw.

Users are strongly advised to implement this mitigation immediately to protect their websites until an official patch is released.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-28074. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart