Skip to main content

Melody CVE-2026-22510

| EUVD-2026-15520 HIGH
Deserialization of Untrusted Data (CWE-502)
2026-03-25 Patchstack
Deserialization Melody
8.1
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Re-analysis Queued
Apr 24, 2026 - 16:37 vuln.today
cvss_changed
EUVD ID Assigned
Mar 25, 2026 - 16:47 euvd
EUVD-2026-15520
Analysis Generated
Mar 25, 2026 - 16:47 vuln.today
CVE Published
Mar 25, 2026 - 16:14 nvd
HIGH 8.1

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in AncoraThemes Melody melodyschool allows Object Injection.This issue affects Melody: from n/a through <= 1.6.3.

AnalysisAI

AncoraThemes Melody melodyschool theme versions up to 1.6.3 contain a PHP object injection vulnerability stemming from unsafe deserialization of untrusted data (CWE-502). This flaw allows attackers to inject malicious serialized objects that can lead to arbitrary code execution or other critical impacts depending on available PHP gadget chains in the WordPress environment. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Craft malicious serialized PHP object
Exploit
Send via vulnerable deserialization endpoint
Execution
Trigger object injection in Melody
Impact
Execute arbitrary code with application privileges
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Remote unauthenticated attacker exploiting AncoraThemes Melody melodyschool versions up to 1.6.3. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment Without a published CVSS vector, EPSS score, or KEV inclusion status, direct quantitative risk assessment is limited. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker crafts a malicious HTTP request containing a serialized PHP object payload targeting a parameter processed by the Melody theme without deserialization safeguards. Upon request processing, the application deserializes the payload, instantiating attacker-controlled objects. …
Remediation Immediately upgrade AncoraThemes Melody to a version higher than 1.6.3 if available from the vendor or theme repository. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 7 days: Identify all affected systems and apply vendor patches promptly. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-22510 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy