PT-2026-50326 · Jwsthemes+1 · Ai Lab

Tran Nguyen Bao Khanh · CVE-2026-42380 · Published 2026-04-27 · Updated 2026-06-17

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AI Lab versions prior to 5.4.2

Description The AI Lab theme for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. PHP Object Injection occurs when an application deserializes data from an untrusted source, potentially allowing an attacker to manipulate the object's properties. While no POP chain is present in the software itself, the presence of a POP chain via another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update to version 5.4.2 or later.

Fix

DoS

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-42380

Affected Products

Ai Lab

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-42380 · Security Note
• https://patchstack.com/database/wordpress/theme/ailab/vulnerability/wordpress-ai-lab-theme-5-4-2-php-object-injection-vulnerability?_s_id=cve · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42380 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/633bb792-69c1-4c10-b64a-123ec149fd14?source=api-prod · Note