CVE-2026-27414

Name of the Vulnerable Software and Affected Versions Werkstatt versions prior to 4.8.4

Description The Werkstatt - Creative Portfolio WordPress Theme is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing an attacker to inject a PHP Object. This issue affects authenticated users with contributor-level access and above. While no native POP chain (a sequence of gadgets used to achieve code execution) is present in the software, the presence of a POP chain via other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update to a version newer than 4.8.3.