CVE-2026-54857

Name of the Vulnerable Software and Affected Versions Quirky versions prior to 1.24

Description The Quirky theme for WordPress allows unauthenticated attackers to perform PHP Object Injection due to the deserialization of untrusted input. Deserialization is the process of converting a stored data format back into an object. While no POP chain (a sequence of gadgets used to execute malicious code) is present in the software itself, the presence of a POP chain via other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update to a version newer than 1.23.