What is the CVSS score of CVE-2026-12256?

CVE-2026-12256 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Avada Theme are affected by CVE-2026-12256?

ThemeFusion Avada, a commercially deployed WordPress theme affecting an estimated 10,000+ sites, contains a critical object injection vulnerability (CVE-2026-12256, CVSS 8.8) enabling authenticated…

How to fix or mitigate CVE-2026-12256?

24 hours: Audit all Contributor-level WordPress accounts on Avada sites; immediately revoke access for inactive or non-essential contributors. 7 days: Implement role-based access controls restricting Contributor privileges to trusted staff only; document timeline with vendor for patch availability. 30 days: Execute remediation-either migrate to alternative WordPress theme or deploy compensating controls (WAF rules, serialization monitoring, plugin-based filtering); establish vendor accountability milestones for security patch release.

Avada Theme CVE-2026-12256

EUVD-2026-37462 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization Avada

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable WordPress endpoint (AV:N), no special conditions beyond a Contributor account (AC:L, PR:L), no victim interaction (UI:N), and PHP object injection typically yields full RCE impacting C/I/A.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:45 vuln.today

DescriptionCVE.org

Contributor PHP Object Injection in Avada <= 3.15.3 versions.

AnalysisAI

PHP Object Injection in the ThemeFusion Avada WordPress theme versions 3.15.3 and earlier allows authenticated users with Contributor-level privileges to trigger unsafe deserialization, potentially leading to remote code execution, data tampering, or service disruption on the underlying WordPress installation. No public exploit identified at time of analysis, but the low attack complexity and widespread deployment of Avada as a commercial WordPress theme make this a meaningful risk for multi-author sites.

Technical ContextAI

Avada is one of the most widely deployed commercial WordPress themes, developed by ThemeFusion and sold via Envato/ThemeForest. The vulnerability is a CWE-502 Deserialization of Untrusted Data issue: PHP's unserialize() function, when fed attacker-controlled input, instantiates arbitrary PHP objects whose magic methods (__wakeup, __destruct, __toString) can be chained into 'POP gadgets' that achieve code execution, file writes, or SQL injection by abusing classes loaded in the WordPress runtime (including core, theme, and any active plugins). The affected CPE is cpe:2.3:a:themefusion:avada:*:*:*:*:*:*:*:* covering all versions up to and including 3.15.3, suggesting the sink resides in a Contributor-accessible code path such as shortcode handling, post meta processing, or AJAX endpoints exposed to lower-privileged authors.

RemediationAI

Upgrade the Avada theme to a version newer than 3.15.3 once ThemeFusion publishes a fixed release; consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/avada/vulnerability/wordpress-avada-theme-3-15-3-php-object-injection-vulnerability and the official ThemeFusion update channel for the exact patched version, as no specific fix version is enumerated in the available data. As compensating controls until patching, audit the WordPress users table and demote or remove untrusted Contributor accounts, disable new user self-registration in Settings → General (trade-off: blocks legitimate sign-ups), and consider deploying Patchstack's virtual patching or a WAF rule that blocks serialized PHP payloads (strings matching /[OC]:\d+:"[^"]+":\d+:\{/) in POST bodies from authenticated low-privilege sessions (trade-off: may break plugins that legitimately accept serialized data). Restricting the Contributor role's capabilities via a role-management plugin can further reduce reachable code paths.