41 premium WordPress themes have a critical flaw, and no fix has been published

What the flaw is

These themes take data a visitor sends and turn it back into program objects without checking it first. In Patchstack’s words, attackers “can manipulate how the site processes data to run harmful actions on the server,” and no login is needed. How far an attacker can take it depends on what other code is installed on the site, but the reports rate it 9.8 out of 10 and none of them suggests waiting to see.

Patchstack, which issued the CVEs, lists “no official patch available” on every one we opened, and none of the CVE records lists a fixed version. The researchers reported most of them to the vendors in February.

Find out which theme your site uses

1. In WordPressGo to Appearance, then Themes. The active theme is listed first.
2. Without logging inOpen your site, right-click, choose View Page Source and search for wp-content/themes/. The folder name after it is the theme.
3. Or run our checkOur free website check reads the theme your pages load and flags versions with known flaws.

Published October 10

• Buzz Stone (ThemeREX) up to 1.0.2, Photolia (ThemeREX) up to 1.0.3, Qwery (AncoraThemes) up to 3.6.1, Jacqueline (ThemeREX) up to 2.22, Alliance (ThemeREX) up to 3.11.
• Kicker (AxiomThemes) up to 2.2.1, Original (AxiomThemes) up to 1.9.0, Anesta (AncoraThemes) up to 1.5.3, FC United (AxiomThemes) up to 1.1.1, ShiftCV (ThemeREX) up to 3.0.14.
• Also that day, with the affected versions in each NVD record: Booklovers, Gutentype, Veto, Travesia, Tantra, Smash, Smart Casa, Rosalinda, Partiso, Let’s Play, IPharm, Hygia, Hogwords, Greeny, Edema, Dwell, Convex, Camelia and Balance.

Published October 23

• Little Birdies (ThemeREX) up to 1.3.16, Rhodos (AxiomThemes) up to 1.3.3, Reprizo (AxiomThemes) up to 1.0.8, Vagabonds (ThemeREX) up to 1.3.10, Redy (AxiomThemes) up to 1.3.5, Holistic Center (AxiomThemes) up to 1.2.6.
• Hallelujah (AxiomThemes) up to 1.1.1, HotLock (ThemeREX) up to 1.3.9, Hostme v2 (AivahThemes) up to 7.0, ZenSoul (ThemeREX) up to 1.13, Save Life (ThemeREX) up to 1.2.14.
• Helion (ThemeREX), rated 8.1 because it’s harder to pull off.

What to do without a fix

1. Ask the sellerContact support wherever you bought the theme and ask when a fixed version is coming. Check again before you do anything drastic.
2. Put a firewall rule in front of itA web application firewall with a virtual patch for these CVEs blocks the attack before it reaches the theme. Patchstack publishes one for its own customers.
3. Keep a backup off the serverIf the site is hit, a backup stored on the same server may go with it.
4. Plan the replacementA theme that sits unpatched for months is a theme to move off. If changing it means redoing the site, that’s a website redesign, and the point to get everything else right too.

Sources

• NVD: ThemeREX vulnerabilities published October 2026
• Patchstack: Qwery theme 3.6.1, PHP object injection
• Patchstack: Little Birdies theme 1.3.16, PHP object injection
• Patchstack: Hostme v2 theme 7.0, PHP object injection
• Patchstack database
• Our vulnerability database: critical WordPress flaws