What is the CVSS score of CVE-2026-27338?

CVE-2026-27338 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Theme are affected by CVE-2026-27338?

A critical object injection vulnerability in AivahThemes Car Zone (versions ≤3.7) allows attackers to execute arbitrary code through deserialization of malicious data.

How to fix or mitigate CVE-2026-27338?

Within 24 hours: Identify all Car Zone installations and their versions; isolate affected systems from production networks if possible and document business justification for any systems remaining connected. Within 7 days: Implement WAF rules blocking suspicious deserialization patterns; restrict administrative access to Car Zone interfaces; enable detailed logging and monitoring for exploitation attempts. Within 30 days: Evaluate upgrade to patched version once available; consider alternative themes if patch timeline extends beyond acceptable risk window; conduct forensic review of access logs for compromise indicators.

Wordpress Theme CVE-2026-27338

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-05 audit@patchstack.com

WordPress Deserialization Wordpress Theme

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 06:16 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in AivahThemes Car Zone carzone allows Object Injection.This issue affects Car Zone: from n/a through <= 3.7.

AnalysisAI

Object injection through unsafe deserialization in AivahThemes Car Zone up to version 3.7 allows authenticated attackers to execute arbitrary code with network access and no user interaction required. With a CVSS score of 8.8 indicating high severity, this vulnerability poses a significant risk to affected installations, though no patch is currently available. Attackers with valid credentials can exploit this flaw to gain complete system compromise including confidentiality, integrity, and availability impact.

Technical ContextAI

Classified as CWE-502 (Deserialization of Untrusted Data). Affects AivahThemes Car Zone carzone. Deserialization of Untrusted Data vulnerability in AivahThemes Car Zone carzone allows Object Injection.This issue affects Car Zone: from n/a through <= 3.7.