Executive brief
The Reina theme for WordPress is vulnerable to a security flaw that allows unauthorized individuals to inject malicious code into a website. This could lead to complete site takeover, data theft, or the site being used to spread further attacks. Business operations could be severely impacted through website defacement or the loss of customer trust and sensitive information.
Technical details
A PHP Object Injection vulnerability exists in the Reina theme for WordPress in versions up to and including 2.1. The flaw stems from the insecure deserialization of user-supplied data (CWE-502), which allows an unauthenticated attacker to inject PHP objects. If a suitable Property-Oriented Programming (POP) chain is present within the environment, this can lead to remote code execution, SQL injection, or unauthorized file access. The attack can be carried out over the network without any user interaction, though the CVSS vector indicates high complexity, likely due to the requirement of a specific POP chain to achieve full impact. A patch is available in version 2.2.
Affected products
- Edge-Themes Reina <= 2.1
Timeline
- 2026-02-12: other: Vulnerability reported by Denver Jackson
- 2026-04-16: disclosed: Initial disclosure by Patchstack
- 2026-06-17: advisory: NVD advisory published
- 2026-04-16: patched: Version 2.2 released to address the vulnerability