What is the CVSS score of CVE-2026-32507?

CVE-2026-32507 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Leroux are affected by CVE-2026-32507?

Organizations using Deserialization of Untrusted Data vulnerability in Elated-Themes Leroux leroux should be aware of moderate risk from CVE-2026-32507, a insecure deserialization vulnerability rated…. A patch is available.

How to fix or mitigate CVE-2026-32507?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Leroux CVE-2026-32507

EUVD-2026-15861 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-x46f-v56p-c92m

Deserialization Leroux

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.4

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15861

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

MEDIUM 5.4

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Elated-Themes Leroux leroux allows Object Injection.This issue affects Leroux: from n/a through < 1.4.

AnalysisAI

A deserialization of untrusted data vulnerability exists in Elated-Themes Leroux WordPress theme versions prior to 1.4, allowing unauthenticated attackers to perform arbitrary object instantiation through object injection attacks. An attacker can exploit this vulnerability to instantiate arbitrary PHP objects, potentially leading to remote code execution or information disclosure depending on available gadget chains in the WordPress environment. While no CVSS score or active KEV status is currently available, the vulnerability has been documented by Patchstack and assigned ENISA EUVD ID EUVD-2026-15861, indicating it is a recognized threat affecting WordPress installations using the vulnerable Leroux theme.

Technical ContextAI

This vulnerability stems from improper deserialization of untrusted data, classified under CWE-502 (Deserialization of Untrusted Data). The Leroux theme (cpe:2.3:a:elated-themes:leroux:*:*:*:*:*:*:*:*) fails to properly validate or sanitize serialized PHP objects before unserializing them, allowing attackers to inject malicious object payloads. When PHP's unserialize() function processes attacker-controlled data without validation, it can instantiate arbitrary classes and trigger magic methods (__wakeup, __destruct, __toString) that are part of available PHP object gadget chains. In WordPress environments, such gadget chains are frequently available through plugins and core functionality, making this attack vector particularly dangerous for theme-level vulnerabilities.

RemediationAI

Immediately upgrade the Leroux theme to version 1.4 or later, which contains the fix for this object instantiation vulnerability. Site administrators should update through the WordPress theme management interface (Appearance > Themes > Updates) or download the patched version directly from the Elated-Themes repository. Until patching is completed, consider temporarily disabling the Leroux theme and switching to a patched alternative theme to prevent exploitation. For WordPress multisite environments or managed hosting scenarios where theme updates cannot be immediately applied, implement additional hardening by restricting administrative access through Web Application Firewall (WAF) rules that detect serialized object patterns in request parameters, and monitor web server logs for suspicious unserialize() activity. Additional details and confirmation of patch availability can be found via the Patchstack vulnerability database referenced in the CVE details.