WordPress RT-Theme 18 Extensions <=2.5 PHP Object Injection Vulnerability Advisory

Vulnerability Overview Vulnerability Name: High Priority PHP Object Injection Vulnerability in WordPress RT-Theme 18 Priority: High Priority CVSS Score: 9.8 Vulnerability Type: PHP Object Injection Publication Date: January 31, 2026 Reporter: Bonds Impact Scope Affected Software: RT-Theme 18 Affected Versions: <= 2.5 Vulnerability Description: This vulnerability allows malicious attackers to execute code injection, SQL injection, path traversal, and denial of service, as well as perform additional actions if a correct POP chain exists. Remediation Official Patch: No official patch available at this time. Recommended Measures: - Update the affected plugin immediately. - If updating is not possible, contact your hosting provider or website developer for assistance. - Use the mitigation rules provided by Patchstack to block attacks until the official patch is available and tested. Additional Information Risk Level: High risk, expected to be exploited, commonly used in large-scale attack campaigns. Mitigation: Patchstack has released mitigation rules to block attacks until the official patch becomes available. Related Links Learn More Get Started with Patchstack Timeline Report Date: January 31, 2026 FAQs How does Patchstack provide the fastest protection? How does Patchstack mitigate vulnerabilities? Why do hackers target my website? What if my website has already been compromised? Subscription Subscribe to WordPress Security Intel: Enter your email address to subscribe to the weekly WordPress security intelligence digest. Footer Information Vulnerability mitigation: Pricing, Application security (SCA), RapidMitigate, Threat Intelligence (API), VS Monars, VS Imunity360, VS Wordfence, Documentation, Service status, Log in Code security: Managed VDP, Active VDP directory, Leaderboard, Report vulnerability, Security auditing, Compliance (DRA), Log in Bug bounty: Bug bounty, Webhosts, Software vendors, Guidelines, Learn, Report, Discord, Log in Use cases: Web developers, Webhosts, Software vendors, WordPress, WooCommerce Resources: Partners, Vulnerability database, Whitepaper 2020, Articles, Case studies, Webinars, Vulnerability statistics Patchstack: About, Compliance, Careers, Merch store, Media kit, LinkedIn, Facebook, X Copyright Information © 2026 Patchstack DPA Privacy Policy Accessibility Terms & Conditions

Goal Reached Thanks to every supporter — we hit 100%!

WordPress RT-Theme 18 Extensions <=2.5 PHP Object Injection Vulnerability Advisory