What is the CVSS score of CVE-2026-22500?

CVE-2026-22500 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of M2 Construction And Tools Store are affected by CVE-2026-22500?

CVE-2026-22500 presents critical security risk, a insecure deserialization vulnerability rated CVSS 9.8.

How to fix or mitigate CVE-2026-22500?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Restrict deserialization to trusted data sources and implement integrity checks.

M2 Construction And Tools Store CVE-2026-22500

EUVD-2026-15507 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-h5vf-v8w8-8c3q

Deserialization M2 Construction And Tools Store

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15507

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in axiomthemes m2 | Construction and Tools Store m2-ce allows Object Injection.This issue affects m2 | Construction and Tools Store: from n/a through <= 1.1.2.

AnalysisAI

A PHP object injection vulnerability exists in the Axiom Themes m2 | Construction and Tools Store theme through version 1.1.2, stemming from unsafe deserialization of untrusted data (CWE-502). This allows remote attackers to inject malicious serialized objects that can lead to arbitrary code execution or privilege escalation depending on available gadget chains in the WordPress environment. No CVSS score, EPSS data, or KEV status is currently available, but the vulnerability was reported by Patchstack and affects all installations running the vulnerable theme version.

Technical ContextAI

The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data), a critical weakness in object-oriented languages like PHP. The m2 | Construction and Tools Store theme (identified via CPE cpe:2.3:a:axiomthemes:m2_|_construction_and_tools_store) unsafely processes serialized PHP objects, likely through unfiltered user input passed to PHP's unserialize() function or similar mechanisms. This is particularly dangerous in WordPress environments where multiple plugins and themes may provide gadget chains (chains of magic methods and function calls) that can be chained together during deserialization to achieve remote code execution. The attack does not require authentication in typical object injection scenarios, making it a direct remote code execution vector.

RemediationAI

Immediately upgrade the m2 | Construction and Tools Store theme to a version newer than 1.1.2 if a patched version is available from Axiom Themes. Until patching is possible, disable the theme or restrict access to the WordPress installation via web application firewall rules that block suspicious serialized object patterns in POST/GET parameters. Implement strict input validation and output encoding across all user-controlled input. For environments where immediate patching is infeasible, monitor for exploitation attempts by logging PHP errors related to object instantiation and reviewing access logs for payloads containing serialized object signatures (e.g., 'O:' patterns). Consult the Patchstack advisory and Axiom Themes security announcements for the availability of patched versions and additional mitigation guidance.