{"id":"CVE-2026-42723","published":"2026-10-10T20:16:37.270","lastModified":"2026-10-13T13:28:15.717","description":"Unauthenticated PHP Object Injection in CleanSkin <= 1.5.0 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/cleanskin/vulnerability/wordpress-cleanskin-theme-1-5-0-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A PHP object injection vulnerability exists in CleanSkin versions 1.5.0 and earlier that allows unauthenticated attackers to inject arbitrary PHP objects into the application's deserialization process. This flaw can lead to remote code execution, data compromise, and full system takeover.","exploitability":"Exploitation is relatively straightforward as it requires no authentication and leverages a vulnerable deserialization endpoint, though successful exploitation may depend on specific PHP configuration or available classes in the application context.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the affected server, potentially leading to complete system compromise, data exfiltration, and lateral movement within the network.","remediation":"Upgrade to CleanSkin version 1.5.1 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","deserialization","web","php"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:46:38.696Z"}}