What is the CVSS score of CVE-2026-32506?

CVE-2026-32506 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Archicon are affected by CVE-2026-32506?

CVE-2026-32506 presents moderate security risk, a insecure deserialization vulnerability rated CVSS 5.4. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-32506?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Archicon CVE-2026-32506

EUVD-2026-15860 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-7jrr-93m5-98fw

Deserialization Archicon

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.7

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15860

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

MEDIUM 5.4

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Edge-Themes Archicon archicon allows Object Injection.This issue affects Archicon: from n/a through < 1.7.

AnalysisAI

A deserialization of untrusted data vulnerability exists in Edge-Themes Archicon WordPress theme versions prior to 1.7, allowing attackers to perform arbitrary object instantiation through object injection attacks. This vulnerability, tracked as CWE-502, enables attackers to instantiate arbitrary PHP objects during the deserialization process, potentially leading to remote code execution or other malicious outcomes depending on available gadget chains in the WordPress environment. The vulnerability was reported by Patchstack and affects all versions of Archicon below 1.7, with a patch available in version 1.7 and later.

Technical ContextAI

The vulnerability stems from unsafe deserialization of untrusted data in the Archicon WordPress theme (CPE: cpe:2.3:a:edge-themes:archicon:*:*:*:*:*:*:*:*). The root cause is classified under CWE-502 (Deserialization of Untrusted Data), a critical class of vulnerability where user-controlled input is passed to PHP's unserialize() function or similar deserialization mechanisms without proper validation. WordPress themes are particularly susceptible to this issue when they accept serialized data from query parameters, POST bodies, cookies, or stored database values without sanitization. During deserialization, PHP instantiates arbitrary objects specified in the serialized payload, and if gadget chains exist within WordPress core or installed plugins, attackers can chain object constructors and destructors to achieve code execution. The Archicon theme likely processes serialized options or theme settings without validating the data integrity or source.

RemediationAI

Immediately upgrade the Archicon WordPress theme to version 1.7 or later, which includes the patch for this deserialization vulnerability. Theme updates can be applied through the WordPress admin dashboard (Appearance > Themes > Archicon > Update) or via CLI using wp theme update archicon. For organizations unable to update immediately, implement input validation and sanitization on any user-controllable data that may be deserialized, though this is insufficient as a long-term mitigation. Additionally, reduce the attack surface by ensuring WordPress and all plugins are kept current, as gadget chains often depend on specific versions of WordPress core functions. Consider implementing Web Application Firewall (WAF) rules to detect and block serialized PHP object patterns in HTTP requests. Until patching is complete, restrict administrative access and monitor PHP error logs for object instantiation warnings. Verify the update was successful by confirming theme version 1.7 or later is active via the WordPress dashboard or wp theme list CLI command.