EUVD-2026-15713
GHSA-2fj3-qvr8-q2c6
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in thememount Apicona apicona allows Object Injection.This issue affects Apicona: from n/a through <= 24.1.0.
AnalysisAI
Apicona, a WordPress theme by thememount, contains a PHP object injection vulnerability stemming from unsafe deserialization of untrusted data (CWE-502). All versions through 24.1.0 are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Authenticated user with login access to Apicona <= 24.1.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Although CVSS and EPSS scores are not currently available, the underlying CWE-502 vulnerability class is consistently high-severity in real-world exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker submits a crafted HTTP request to a web form or REST endpoint in a WordPress site running Apicona, embedding a malicious serialized PHP object in a parameter. When Apicona deserializes this data without validation, the object instantiation triggers a gadget chain present in WordPress or installed plugins, resulting in arbitrary PHP code execution on the web server. … |
| Remediation | Immediately upgrade Apicona to a version newer than 24.1.0 if a patched release is available from thememount. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 7 days: Identify all affected systems and apply vendor patches promptly. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today