{"id":"CVE-2026-78533","published":"2026-10-10T20:16:47.133","lastModified":"2026-10-13T13:29:12.567","description":"Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/qwery/vulnerability/wordpress-qwery-theme-3-6-1-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical PHP object injection vulnerability exists in Qwery versions up to 3.6.1, allowing unauthenticated attackers to inject arbitrary PHP objects and execute code remotely. This flaw enables full system compromise without requiring authentication.","exploitability":"Exploitation is straightforward with no authentication required, though it may need a specific request pattern or parameter handling to trigger the deserialization vulnerability.","blast_radius":"The impact could be severe across all affected Qwery installations, potentially leading to complete server takeover and data compromise for any vulnerable system.","remediation":"Upgrade to Qwery version 3.6.2 or later to remediate this critical vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","php","deserialization","web"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:49:54.551Z"}}