CVE-2026-96831

Executive Summary

CVE-2026-96831 is a PHP Object Injection vulnerability (CWE-502) in the Themify Builder WordPress plugin affecting versions up to and including 7.8.1. The flaw allows an authenticated attacker with low privileges (as reflected by the CVSS PR:L metric) to pass attacker-controlled serialized data that is deserialized by the plugin, potentially enabling arbitrary PHP object instantiation and, through gadget chains present in the WordPress ecosystem, remote code execution. With a CVSS base score of 8.8 and High confidentiality, integrity, and availability impacts, this represents a serious risk for any WordPress site running a vulnerable Themify Builder installation, and no official patch or vendor fix has been identified.

Technical Analysis

CVE-2026-96831 is classified under CWE-502, Deserialization of Untrusted Data, and specifically manifests as a PHP Object Injection (POI) vulnerability. The NVD description identifies the affected component as "Contributor" within Themify Builder versions up to and including 7.8.1.

PHP Object Injection vulnerabilities arise when an application passes user-supplied input to an unsafe deserialization function such as unserialize(). In the WordPress plugin ecosystem, this typically occurs when attacker-controlled data (such as a shortcode attribute, post meta value, AJAX parameter, or serialized option field) is deserialized without adequate validation. Because PHP's unserialize() reconstructs arbitrary objects and triggers magic methods (__wakeup(), __destruct(), __toString(), __call()), an attacker who can supply a crafted serialized string can instantiate objects of classes loaded anywhere in the runtime.

The NVD entry does not disclose the specific vulnerable file, function, parameter, or code path. No function names, hooks, endpoints, or class names are provided in the CNA title or NVD description. Accordingly, this report describes the vulnerability strictly at the class level and does not fabricate implementation details that are not present in the supplied data.

What is known from the metadata:

• Attack vector (AV:N): The vulnerability is reachable over the network, consistent with a web-facing WordPress plugin.
• Attack complexity (AC:L): No special conditions or race windows are required; a crafted request suffices.
• Privileges required (PR:L): An authenticated user with low privileges is sufficient. The descriptor "Contributor" in the title strongly suggests a WordPress Contributor-role user is the minimum privilege threshold — a relatively low bar, since contributors can self-register on many sites or be provisioned in multi-author environments.
• User interaction (UI:N): No victim interaction is required.
• Scope (S:U): The impact is confined to the vulnerable component's security authority.
• Impact (C:H/I:H/A:H): Full loss of confidentiality, integrity, and availability is possible — consistent with the potential for code execution that POI enables when a suitable gadget chain is available.

The practical exploitation of POI depends on the presence of a POP (Property-Oriented Programming) gadget chain within the loaded codebase, including WordPress core, other installed plugins, and the active theme. PHP object injection on its own yields arbitrary object instantiation; escalation to RCE, file deletion, or SSRF depends on available gadgets. It is not established from the provided data whether such a chain is reachable in any given Themify Builder deployment, so the realistic worst-case impact must be treated as potentially full site compromise.

No public proof-of-concept, exploit code, or Nuclei template was identified for this CVE, and EPSS has not yet assigned a score. The absence of a vendor patch and any tracked patch source raises the risk profile further.

Exploitation Scenarios

The following attack chain is described at the vulnerability-class level, since the NVD description provides no specific file paths, functions, or parameters. No public PoC is available; the chain is inferred from CWE-502 and the plugin's WordPress context.

1. Reconnaissance and target identification. An adversary enumerates WordPress sites and fingerprints the Themify Builder plugin and its version, for example via publicly served plugin assets, readme.txt, or the themify-builder plugin directory path. Targets running version <= 7.8.1 are flagged as vulnerable.

2. Privilege acquisition. Because the CVSS vector requires low privileges (PR:L) and the title references a "Contributor," the attacker obtains at minimum a Contributor-level account. This is often trivial on multi-author blogs, membership sites, or sites with open registration; otherwise it may be obtained through credential stuffing or phishing of a low-privileged user.

3. Triggering the deserialization sink. The attacker submits input that the Themify Builder plugin passes to a PHP unserialization function. The precise entry point (shortcode, AJAX action, REST callback, or post field) is not disclosed in the available data. The attacker crafts a serialized payload (O:<length>:"ClassName":<count>:{...}) referencing gadget classes present in WordPress core, the active theme, or other installed plugins.

4. Object instantiation and gadget chaining. When unserialize() processes the payload, the target objects are reconstructed, and their magic methods fire. A well-formed POP chain can pivot from object instantiation to arbitrary file write, arbitrary file read, or remote code execution depending on the gadgets available on the target.

5. Post-exploitation impact. On successful chaining, the attacker can achieve effects ranging from sensitive data disclosure to full remote code execution, giving control of the WordPress installation, its database, and potentially the underlying host depending on server configuration. Even without a working gadget chain, object injection alone may allow tampering with plugin/theme state and integrity-breaking modifications.

If no usable gadget chain exists on a given site, the exploit may fail to escalate beyond object instantiation, and impact would be limited. However, given the breadth of the WordPress plugin ecosystem, the possibility of a reachable chain should be assumed until proven otherwise.

Impact Assessment

• Confidentiality (C:H): Full read access to data accessible to the web server and application is possible in the worst case, including configuration files (e.g., wp-config.php), database credentials, and user data.
• Integrity (I:H): The attacker may modify site content, plugin/theme files, or inject persistent backdoors.
• Availability (A:H): Destruction or disabling of site functionality, including denial of service, is possible in the worst case.
• Scope (S:U): Impact is contained within the security authority of the vulnerable component, but in the context of a WordPress install that component frequently has broad filesystem and database reach.
• Base score: 8.8 (High). The combination of network reachability, low complexity, low privilege requirement, and no user interaction produces a high severity despite PR:L.
• Blast radius: Any WordPress site running Themify Builder <= 7.8.1 is potentially affected. Sites with a reachable POP gadget chain from other installed plugins or the theme face elevated risk of full compromise. Sites without such a chain may still face object-injection-level integrity impacts.
• Authentication barrier: The requirement for a low-privileged account (Contributor) moderates remote unauthenticated exploitation, but this barrier is low and easy to bypass on sites with open registration or weak credential hygiene.

Because no CISA KEV listing exists and no exploit code or PoC has been published, mass exploitation is not currently evidenced. This does not preclude targeted exploitation, and the unpatched status warrants proactive mitigation.

Detection Guidance

Detection must focus on two planes: (a) malicious serialized payloads reaching PHP endpoints, and (b) anomalous post-exploitation behavior on WordPress hosts. Since the exact vulnerable parameter is unknown, detections are deliberately broad and target the general POI pattern.

Sigma Rule

title: Suspicious PHP Serialized Object Payloads Targeting WordPress Plugins
id: 8f3a2c9e-2b71-4e6a-9b5f-themify96831
status: experimental
description: Detects HTTP requests containing PHP serialized object markers (O:<len>:"") consistent with PHP Object Injection attempts against WordPress plugins such as Themify Builder (CVE-2026-96831).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96831
author: valtersit.com
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method: 'POST'
  selection_body:
    cs-uri-query|contains:
      - 'O:'
      - '%3A'
    cs-uri-query|re: 'O:\d+:"[A-Za-z0-9_\\]+":\d+:\{'
  selection_ua:
    cs-User-Agent|contains:
      - 'python-requests'
      - 'curl'
      - 'Go-http-client'
  condition: selection_method and selection_body
fields:
  - c-ip
  - cs-uri
  - cs-uri-query
level: high
tags:
  - attack.t1190
  - cve.2026.96831

YARA Rule

rule CVE_2026_96831_Themify_PHP_Object_Injection
{
    meta:
        author = "valtersit.com"
        description = "Detects PHP serialized object payload patterns indicative of PHP Object Injection (CWE-502) targeting Themify Builder <= 7.8.1"
        cve = "CVE-2026-96831"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96831"
        date = "2026-01-01"

    strings:
        $ser1 = /O:[0-9]{1,5}:"[a-zA-Z_\\][a-zA-Z0-9_\\]{2,60}":[0-9]{1,4}:\{/
        $ser2 = "O:14:\"Themify_Builder\""
        $ser3 = /unserialize\s*\(\s*\$_/
        $php1 = "themify-builder"
        $php2 = "themify_builder"

    condition:
        uint32(0) == 0x3C3F7068 or // "<?ph"
        any of ($php1, $php2) or
        ($ser1 and 1 of ($ser2, $ser3))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96831 Themify Builder PHP Object Injection Attempt"; \
 flow:established,to_server; \
 http.method; content:"POST"; \
 http.uri; content:"themify"; nocase; \
 http.request_body; pcre:"/O:[0-9]{1,5}:\"[a-zA-Z_\\\\][a-zA-Z0-9_\\\\]+\":[0-9]{1,4}:\{/"; \
 reference:cve,CVE-2026-96831; \
 classtype:web-application-attack; \
 sid:90096831; rev:1;)

Elastic Detection

sequence by host.name, process.args
  [network where http.request.method == "POST" and
   http.request.body.text =~ "O:[0-9]+:\"[A-Za-z_\\\\\\\\][A-Za-z0-9_\\\\\\\\]+\":[0-9]+:\\{"]
  [file where event.action == "modification" and
   (file.path like "*wp-content/plugins/*" or file.path like "*wp-content/uploads/*")]

Splunk SPL Query

index=web sourcetype=access_combined
| eval ser_hit = if(match(_raw, "O:[0-9]{1,5}:\"[A-Za-z_\\\\][A-Za-z0-9_\\\\]+\":[0-9]{1,4}:\{"), 1, 0)
| eval themify_hit = if(match(lower(cs_uri), "themify") OR match(lower(cs_referer), "themify"), 1, 0)
| where ser_hit=1 OR (themify_hit=1 AND status>=200 AND status<500)
| stats count min(_time) as first_seen max(_time) as last_seen
    by clientip, cs_uri, cs_method, status
| sort - count
| table first_seen, last_seen, clientip, cs_method, cs_uri, status, count

Wazuh OSSEC Rule

<group name="web,wordpress,cve-2026-96831,">
  <rule id="10096831" level="12">
    <if_sid>31100</if_sid>
    <id>^POST$</id>
    <url>themify</url>
    <regex>O:\d{1,5}:"[A-Za-z_\\][A-Za-z0-9_\\]+":\d{1,4}:\{</regex>
    <description>CVE-2026-96831: Possible PHP Object Injection (Themify Builder) - serialized object payload to plugin endpoint</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_96831,attack,t1190,</group>
  </rule>

  <rule id="10096832" level="10">
    <if_sid>550</if_sid>
    <field name="file">wp-content/plugins/themify-builder</field>
    <description>CVE-2026-96831: File modification in Themify Builder plugin directory - possible post-exploitation persistence</description>
    <group>cve_2026_96831,integrity,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version security release has been identified. Treat all Themify Builder installations at version <= 7.8.1 as vulnerable.

1) Immediate mitigations

• Disable or remove the plugin if it is not business-critical. This is the only fully reliable mitigation absent a patch.
• Restrict low-privilege account provisioning. Because exploitation requires at least Contributor-level access, disable open user registration and audit existing Contributor accounts. Enforce strong authentication (MFA) on all accounts.
• Limit plugin entry points. Where a WAF is available, deploy virtual patching rules that block HTTP requests containing PHP serialized object markers (O:<len>:"Class") to plugin endpoints.
• Least privilege on the web server. Ensure the web user cannot write to PHP files or modify plugin code, reducing the impact of a successful gadget chain.
• Monitor for IOCs using the detection content in the prior section.

2) Patch / upgrade steps

• No patch exists. Monitor the vendor channel and the NVD entry (CVE-2026-96831) for a fixed release and apply it as soon as available.
• Until then, if the plugin must remain online, isolate it behind strict input validation at the proxy layer and maintain offline integrity monitoring of the plugin directory.
• After any patch release, verify the deployed version matches a fixed release and re-scan the site for webshells or injected content.

3) Long-term hardening

• Maintain an inventory of WordPress plugins and versions with automated vulnerability feeds; subscribe to CVE notifications for plugin dependencies.
• Restrict Contributor and Author capabilities on production sites that do not require multi-author publishing.
• Deploy a WAF with PHP-object-injection signatures and keep it in blocking mode for known vulnerable plugins.
• Enforce file integrity monitoring on wp-content/plugins/ and wp-content/uploads/.
• Apply defense-in-depth: disable PHP execution in upload directories, minimize installed plugins, and keep WordPress core and all dependencies current.

References

1. NVD — CVE-2026-96831: https://nvd.nist.gov/vuln/detail/CVE-2026-96831
2. CWE-502: Deserialization of Untrusted Data — https://cwe.mitre.org/data/definitions/502.html
3. OWASP — PHP Object Injection: https://owasp.org/www-community/vulnerabilities/PHP_Object_Injection
4. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
5. Themify Builder (vendor product page for patch monitoring): https://themify.me/

No threat actor campaigns, exploit-in-the-wild evidence, CISA KEV listing, public PoC, or Nuclei template was identified for this CVE at the time of writing. EPSS has not yet been scored by FIRST.org.