PT-2026-26058 · Shinetheme · Shinetheme Traveler

Phat Rio · CVE-2026-25449 · Published 2026-03-18 · Updated 2026-03-18

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shinetheme Traveler versions prior to 3.2.8.1

Description The Shinetheme Traveler software contains a flaw related to the deserialization of untrusted data, which can lead to object injection. This issue allows for potential remote code execution.

Recommendations Update Shinetheme Traveler to version 3.2.8.1 or later.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-25449

Affected Products

Shinetheme Traveler

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-25449 · Security Note
• https://reddit.com/r/pwnhub/comments/1rxfc4z/critical_shinetheme_traveler_vulnerability · Reddit Post
• https://patchstack.com/database/wordpress/theme/traveler/vulnerability/wordpress-traveler-theme-3-2-8-php-object-injection-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/Wordpress/Theme/traveler/vulnerability/wordpress-traveler-theme-3-2-8-php-object-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/0dayPublishing/status/2034263333633765638 · Twitter Post
• https://twitter.com/CveFindCom/status/2034279415102705778 · Twitter Post
• https://twitter.com/TheHackerWire/status/2034359177121055210 · Twitter Post
• https://twitter.com/CVEnew/status/2034365289127965042 · Twitter Post