What is the CVSS score of CVE-2026-22510?

CVE-2026-22510 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Melody are affected by CVE-2026-22510?

CVE-2026-22510 presents notable security risk, a insecure deserialization vulnerability rated CVSS 8.1.

How to fix or mitigate CVE-2026-22510?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Restrict deserialization to trusted data sources and implement integrity checks.

Melody CVE-2026-22510

EUVD-2026-15520 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

Deserialization Melody

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15520

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in AncoraThemes Melody melodyschool allows Object Injection.This issue affects Melody: from n/a through <= 1.6.3.

AnalysisAI

AncoraThemes Melody melodyschool theme versions up to 1.6.3 contain a PHP object injection vulnerability stemming from unsafe deserialization of untrusted data (CWE-502). This flaw allows attackers to inject malicious serialized objects that can lead to arbitrary code execution or other critical impacts depending on available PHP gadget chains in the WordPress environment. While no CVSS score or EPSS data is currently published and KEV status is unknown, the vulnerability affects a WordPress theme distributed through the Patchstack vulnerability database, indicating active tracking by the security community.

Technical ContextAI

The vulnerability exists in the AncoraThemes Melody theme (CPE: cpe:2.3:a:ancorathemes:melody:*:*:*:*:*:*:*:*) and exploits unsafe PHP object deserialization practices. CWE-502 (Deserialization of Untrusted Data) describes scenarios where an application deserializes data from an untrusted source without proper validation, allowing attackers to instantiate arbitrary PHP objects. In WordPress theme contexts, this commonly occurs when plugins or themes use PHP's unserialize() function on user-supplied input, GET/POST parameters, or data from databases without prior sanitization. If the WordPress environment contains exploitable PHP classes (gadget chains), attackers can chain object instantiation to achieve remote code execution or privilege escalation.

RemediationAI

Immediately upgrade AncoraThemes Melody to a version higher than 1.6.3 if available from the vendor or theme repository. Consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/melodyschool/vulnerability/wordpress-melody-theme-1-6-3-php-object-injection-vulnerability) for patched version availability and installation instructions. As an interim mitigation, restrict direct access to the affected theme's PHP files via web server rules, implement input validation and sanitization for any user-supplied data processed by the theme, and monitor application logs for suspicious serialized object patterns in request payloads. Consider disabling the Melody theme entirely and switching to an alternative until a patch is confirmed; additionally, audit all WordPress plugins in the same environment for known gadget chains that could be leveraged in conjunction with this vulnerability.