What is the CVSS score of CVE-2026-25400?

CVE-2026-25400 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Apicona are affected by CVE-2026-25400?

Organizations using Deserialization of Untrusted Data vulnerability in thememount Apicona apicona face significant risk from CVE-2026-25400, a insecure deserialization vulnerability rated CVSS 8.8.

How to fix or mitigate CVE-2026-25400?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Restrict deserialization to trusted data sources and implement integrity checks.

Apicona CVE-2026-25400

EUVD-2026-15713 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-2fj3-qvr8-q2c6

Deserialization Apicona

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15713

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in thememount Apicona apicona allows Object Injection.This issue affects Apicona: from n/a through <= 24.1.0.

AnalysisAI

Apicona, a WordPress theme by thememount, contains a PHP object injection vulnerability stemming from unsafe deserialization of untrusted data (CWE-502). All versions through 24.1.0 are affected. An attacker can exploit this to inject arbitrary objects into the application, potentially leading to remote code execution or other malicious object manipulation depending on available gadget chains within the PHP environment.

Technical ContextAI

The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data), a well-known attack vector in PHP applications where unfiltered user input is passed to unserialize() or similar deserialization functions. Apicona (cpe:2.3:a:thememount:apicona:*:*:*:*:*:*:*:*), a WordPress theme, fails to properly sanitize or validate serialized data before deserializing it. This allows attackers to craft malicious serialized objects that, when unserialized by the application, can invoke object-oriented gadget chains to achieve arbitrary code execution or privilege escalation. The issue affects all versions from an undefined baseline through version 24.1.0, indicating the vulnerability was present for an extended period without remediation.

RemediationAI

Immediately upgrade Apicona to a version newer than 24.1.0 if a patched release is available from thememount. Until a security patch is released, implement the following mitigations: disable or remove the vulnerable Apicona theme and substitute it with an alternative WordPress theme; implement strict input validation and sanitization across all theme functionality; apply a Web Application Firewall (WAF) rule to block serialized object patterns in user input; and enforce PHP security configurations such as disabling dangerous functions if applicable. Contact thememount directly for an official security advisory and patch timeline. Monitor Patchstack and ENISA EUVD (EUVD-2026-15713) for patch announcements.