What is the CVSS score of CVE-2026-22505?

CVE-2026-22505 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Morning Records are affected by CVE-2026-22505?

CVE-2026-22505 presents notable security risk, a insecure deserialization vulnerability rated CVSS 8.1.

How to fix or mitigate CVE-2026-22505?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Restrict deserialization to trusted data sources and implement integrity checks.

Morning Records CVE-2026-22505

EUVD-2026-15513 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-wjqp-gqv9-x8vx

Deserialization Morning Records

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15513

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in AncoraThemes Morning Records morning-records allows Object Injection.This issue affects Morning Records: from n/a through <= 1.2.

AnalysisAI

A PHP object injection vulnerability exists in AncoraThemes Morning Records WordPress theme through version 1.2, arising from unsafe deserialization of untrusted data (CWE-502). This flaw allows attackers to inject malicious objects that can lead to arbitrary code execution or other severe impacts depending on available PHP gadget chains in the WordPress environment. While no CVSS score or EPSS data is currently published, the vulnerability has been documented by Patchstack security researchers, indicating active awareness in the security community.

Technical ContextAI

The vulnerability stems from improper handling of serialized PHP objects within the Morning Records theme, classified under CWE-502 (Deserialization of Untrusted Data). PHP object injection occurs when user-controlled data is passed to dangerous functions like unserialize() without proper validation or integrity checks. The affected product is identified via CPE cpe:2.3:a:ancorathemes:morning_records:*:*:*:*:*:*:*:*, indicating the vulnerability affects the Morning Records WordPress theme across all versions up to and including 1.2. The attack leverages PHP's magic methods (__wakeup, __destruct, __toString) and available gadget chains within WordPress or installed plugins to achieve exploitation, potentially leading to remote code execution if suitable gadgets are present in the target environment.

RemediationAI

Immediately upgrade AncoraThemes Morning Records to a patched version newer than 1.2 if available; consult the vendor advisory via Patchstack for the specific recommended version. Until a patch is deployed, implement strict input validation and serialization controls at the application level by reviewing and sanitizing any user-supplied data before it enters deserialization functions, ensuring unserialize() is never called on untrusted input. Additionally, consider disabling PHP object serialization in the theme configuration if possible, restricting file upload capabilities, and implementing Web Application Firewall (WAF) rules to detect suspicious serialized object patterns. Monitor WordPress security channels and the Patchstack database for patch availability, and keep WordPress core and all plugins updated to minimize gadget chain availability in the environment.