VulnSocial

CVE-2026-25449Disclosure

LOWCVSS 9.8 · CRITICAL

Signal is active with 4 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Deserialization of Untrusted Data vulnerability in shinetheme Traveler traveler allows Object Injection.This issue affects Traveler: from n/a through < 3.2.8.1.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-502

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 4 mentions across 1 observed day

What's happening

  • Technical details provided in 4 signals
  • Disclosure: 4 classified signals
  • 4 total mentions across 1 day

Deep dive

Activity timeline4 mentions / 1d
01234Mentions · 2026-03-18: 4Technical Details · 2026-03-18: 403-18
Signal classification1 categories
Disclosure
4100.0%
Referenced assets4 URLs
Full discourse4 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-25449 Deserialization of Untrusted Data vulnerability in Shinetheme Traveler allows Object Injection.This issue affects Traveler: from n/a before 3.2.8.1. https://www.cve.org/CVERecord?id=CVE-2026-25449

    Post summary

    The text references CVE-2026-25449, describing an object injection vulnerability through deserialization in Shinetheme Traveler, indicating affected versions but lacking PoC, exploit, or patch details.

    00000124
    56.7K followersView on X
  • The Hacker Wire@TheHackerWire
    Disclosure

    🔴 CVE-2026-25449 - Critical Deserialization of Untrusted Data vulnerability in Shinetheme Traveler allows Object Injection.This issue affects Traveler: from n/a before 3.2.8.1. https://www.thehackerwire.com/vulnerability/CVE-2026-25449/ https://t.co/5Mta5cM7pO

    Post summary

    The post announces CVE-2026-25449, a critical deserialization flaw in Shinetheme Traveler enabling object injection, without evidence of proven exploitation or mitigation.

    0000030
    138 followersView on X
  • CVEFind.com@CveFindCom
    Disclosure

    [CVE-2026-25449: CRITICAL] Deserialization of Untrusted Data vulnerability in Shinetheme Traveler allows Object Injection.This issue affects Traveler: from n/a before 3.2.8.1.#cve,CVE-2026-25449,#cybersecurity https://cvefind.com/CVE-2026-25449

    Post summary

    The text announces CVE‑2026‑25449, detailing a deserialization vulnerability in Shinetheme Traveler that permits object injection, but it does not offer a PoC, exploit, or patch.

    0000045
    603 followersView on X
  • 0day Signal@0dayPublishing
    Disclosure

    🚨 CVE-2026-25449: WordPress Traveler theme &lt; 3.2.8... PHP object injection in WordPress Traveler theme with 9.8 CVSS and zero auth requirements - RCE goldmine for mass WordP... https://zerodaysignal.com/vulnerability/CVE-2026-25449 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    The post discloses a high‑severity PHP object injection flaw in WordPress Traveler (<3.2.8) that allows unauthenticated remote code execution.

    0000059
    155 followersView on X

Explore more

Back to dashboard