What is the CVSS score of CVE-2026-27098?

CVE-2026-27098 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Theme are affected by CVE-2026-27098?

A critical deserialization vulnerability in the Au Pair Agency WordPress theme (versions ≤1.2.2) allows attackers to inject malicious objects, potentially compromising websites using this plugin.

How to fix or mitigate CVE-2026-27098?

Within 24 hours: Identify all WordPress installations using Au Pair Agency theme ≤1.2.2 and document affected sites; disable the theme on non-critical systems if possible. Within 7 days: Contact the theme vendor for patch availability and timeline; implement WAF rules to block malicious serialized object patterns in POST requests; consider switching to an alternative theme if vendor support is unavailable. Within 30 days: Apply vendor patch immediately upon release; conduct security audit of affected sites for signs of compromise; implement WordPress security hardening and regular vulnerability scanning.

Wordpress Theme CVE-2026-27098

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-05 audit@patchstack.com

WordPress Deserialization Wordpress Theme

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.1

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in axiomthemes Au Pair Agency - Babysitting & Nanny Theme au-pair-agency allows Object Injection.This issue affects Au Pair Agency - Babysitting & Nanny Theme: from n/a through <= 1.2.2.

AnalysisAI

Unsafe deserialization in the Au Pair Agency theme (versions up to 1.2.2) enables object injection attacks that could allow remote code execution on affected WordPress sites. An unauthenticated attacker can exploit this vulnerability to inject malicious objects and compromise server integrity, confidentiality, and availability. No patch is currently available.

Technical ContextAI

Classified as CWE-502 (Deserialization of Untrusted Data). Deserialization of Untrusted Data vulnerability in axiomthemes Au Pair Agency - Babysitting & Nanny Theme au-pair-agency allows Object Injection.This issue affects Au Pair Agency - Babysitting & Nanny Theme: from n/a through <= 1.2.2.