{"id":"CVE-2026-78535","published":"2026-10-10T20:16:47.380","lastModified":"2026-10-13T13:29:12.567","description":"Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-502"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/theme/photolia/vulnerability/wordpress-photolia-theme-1-0-3-php-object-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"A critical PHP object injection vulnerability exists in Photolia versions 1.0.3 and earlier, allowing unauthenticated attackers to inject arbitrary PHP objects that can lead to remote code execution, data compromise, or system takeover.","exploitability":"Exploitation is relatively straightforward with no authentication required, though it may depend on the application's configuration and whether specific endpoints are exposed to external access.","blast_radius":"If exploited, this vulnerability could allow attackers to execute arbitrary code on the affected server, potentially leading to full system compromise, data exfiltration, or further lateral movement within the network.","remediation":"Upgrade to Photolia version 1.0.4 or later to remediate this vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","php-injection","web","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:49:59.711Z"}}