What is the CVSS score of CVE-2026-27082?

CVE-2026-27082 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Love Story are affected by CVE-2026-27082?

CVE-2026-27082 presents critical security risk, a insecure deserialization vulnerability rated CVSS 9.8.

How to fix or mitigate CVE-2026-27082?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Restrict deserialization to trusted data sources and implement integrity checks.

Love Story CVE-2026-27082

EUVD-2026-15791 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-382x-9fjr-hvxc

Deserialization Love Story

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15791

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in ThemeREX Love Story lovestory allows Object Injection.This issue affects Love Story: from n/a through <= 1.3.12.

AnalysisAI

A PHP Object Injection vulnerability exists in ThemeREX Love Story WordPress theme through version 1.3.12, stemming from unsafe deserialization of untrusted data. This vulnerability allows attackers to inject malicious serialized objects that can lead to remote code execution or other object-oriented attack chains. The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) and has been reported by Patchstack; no CVSS score or EPSS data is currently available, and KEV status is unknown.

Technical ContextAI

The vulnerability resides in the ThemeREX Love Story WordPress theme (CPE: cpe:2.3:a:themerex:love_story:*:*:*:*:*:*:*:*) and involves unsafe PHP object deserialization. CWE-502 describes the root cause: when PHP's unserialize() function (or similar mechanisms) processes untrusted input without proper validation, attackers can craft serialized payloads that instantiate arbitrary objects. This is particularly dangerous in WordPress themes and plugins where magic methods like __wakeup(), __destruct(), or __toString() can be chained with existing classes to achieve code execution or information disclosure. The Love Story theme likely accepts user-controlled serialized data through request parameters, AJAX handlers, or database fields without sanitization.

RemediationAI

Immediately update the ThemeREX Love Story theme to a version newer than 1.3.12 if a patched version is available from the vendor; check the Patchstack database entry and the theme's official repository (WordPress.org or ThemeREX's site) for the latest release. Until a patch is confirmed and deployed, implement input validation and sanitization in any custom code that handles serialized data, disable PHP object deserialization of untrusted sources by avoiding unserialize() on user input, and apply Web Application Firewall (WAF) rules to detect and block serialized PHP object payloads. Additionally, audit other themes and plugins for similar deserialization issues and maintain a current WordPress and plugin update schedule to reduce the attack surface.