{"id":"CVE-2026-78531","published":"2026-10-10T20:16:46.830","lastModified":"2026-10-13T13:29:12.567","description":"Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/jacqueline/vulnerability/wordpress-jacqueline-theme-2-22-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical PHP object injection vulnerability exists in Jacqueline versions up to 2.22, allowing unauthenticated attackers to inject arbitrary PHP objects and execute code remotely.","exploitability":"Exploitation is relatively straightforward with no authentication required, though it may depend on specific application configuration or data handling patterns that allow the injected objects to be unserialized.","blast_radius":"The vulnerability could lead to full remote code execution across all affected installations, potentially compromising entire web servers and applications running Jacqueline.","remediation":"Upgrade to Jacqueline 2.23 or later to remediate this critical vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","php","web","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:49:49.642Z"}}