Executive brief
PressMart is a WordPress theme used for building e-commerce and business websites. A security flaw in versions 1.2.26 and earlier allows an unauthenticated attacker to inject malicious code into the site. If successfully exploited, this could lead to full site takeover, data theft, or the complete disruption of business operations.
Technical details
The PressMart theme for WordPress is vulnerable to PHP Object Injection via the deserialization of untrusted data (CWE-502). This occurs because the application fails to properly validate user-supplied input before passing it to a PHP deserialization function. An unauthenticated remote attacker can exploit this by sending a specially crafted payload to the server. If a suitable Property-Oriented Programming (POP) chain is present within the environment, the attacker could achieve remote code execution, perform SQL injection, or access sensitive files. The vulnerability is patched in version 1.2.27.
Affected products
- PressLayouts PressMart <= 1.2.26
Timeline
- 2026-02-12: other: Reported by Phat RiO
- 2026-04-22: disclosed: Initial disclosure by Patchstack
- 2026-06-17: advisory: NVD publication date