Read the docs
TI-2026-36331 Aliases CVE-2026-49107GHSA-hfw7-349x-x9m5

WordPress Thrive Apprentice plugin < 10.8.10.2 - PHP Object Injection vulnerability

Priority MEDIUM 49CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00375 31st percentileScored 2026-11-07
Fix Fixed Thrive Apprentice (Thrive Themes): 10.8.10.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Thrive ThemesThrive Apprenticebefore 10.8.10.210.8.10.2Patch availableCNA
  • Thrive Apprentice VendorThrive Themes Affected before 10.8.10.2 Fixed in 10.8.10.2 Patch available CNA

Remediation

  • Fix · CNA Thrive Apprentice (Thrive Themes) Fixed in 10.8.10.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-49107
  2. 2026-10-03 Alias added: GHSA-hfw7-349x-x9m5

References

Other 1

  • TI-2021-06512 All Thrive Themes Legacy Themes < 2.0.0 - Unauthenticated Arbitrary File Upload and Option Deletion CVSS 3.1CRITICAL 9.1
  • TI-2023-25892 WordPress Thrive Theme Builder theme < 3.24.0 - Authenticated Privilege Escalation vulnerability CVSS 3.1HIGH 8.8
  • TI-2023-28183 WordPress Thrive Automator Plugin <= 1.17 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
  • TI-2023-25891 WordPress Thrive Theme Builder Theme < 3.24.2 is vulnerable to Cross Site Request Forgery (CSRF) CVSS 3.1HIGH 8.8
  • TI-2023-25893 WordPress Thrive Theme Builder theme < 3.24.0 - Multiple Authenticated Broken Access Control vulnerability CVSS 3.1HIGH 8.3
  • TI-2021-06511 All Thrive Themes and Plugins - Unauthenticated Option Update CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences