What is the CVSS score of CVE-2026-32508?

CVE-2026-32508 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Halstein are affected by CVE-2026-32508?

CVE-2026-32508 presents moderate security risk, a insecure deserialization vulnerability rated CVSS 5.4. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-32508?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Halstein CVE-2026-32508

EUVD-2026-15862 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-p662-9cjc-934w

Deserialization Halstein

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.8

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15862

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

MEDIUM 5.4

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Mikado-Themes Halstein halstein allows Object Injection.This issue affects Halstein: from n/a through < 1.8.

AnalysisAI

This is a deserialization of untrusted data vulnerability in the Mikado-Themes Halstein WordPress theme (versions prior to 1.8) that allows arbitrary object injection via CWE-502. An attacker can exploit this flaw to instantiate arbitrary PHP objects, potentially leading to remote code execution or information disclosure depending on available gadget chains. The vulnerability was reported by Patchstack and affects all versions of Halstein below 1.8; no CVSS score, EPSS data, or KEV status is currently published, limiting immediate risk quantification but indicating this is a serious deserialization flaw that should be patched urgently.

Technical ContextAI

The vulnerability stems from unsafe deserialization of untrusted data in the Halstein theme, classified under CWE-502 (Deserialization of Untrusted Data). WordPress themes often process serialized PHP objects from user input, database queries, or external sources without proper validation. When an application deserializes untrusted data using PHP's unserialize() function without constraints, attackers can craft malicious serialized objects that instantiate arbitrary classes, triggering magic methods (__wakeup, __destruct, __toString) that may exist in available libraries or the WordPress core. The affected product is identified via CPE cpe:2.3:a:mikado-themes:halstein:*:*:*:*:*:*:*:* and the flaw allows arbitrary object injection, a technique that chains gadgets in loaded classes to achieve code execution or other malicious outcomes.

RemediationAI

Immediately upgrade Mikado-Themes Halstein to version 1.8 or later from the official WordPress theme repository or vendor website. Site administrators should verify the installed version via the WordPress admin dashboard and apply the update without delay. Until patching is feasible, implement network-level controls by restricting access to the WordPress admin and plugin upload directories via firewall rules or Web Application Firewall (WAF) policies, disable unnecessary serialization features if possible through theme settings, and monitor logs for suspicious deserialization attempts. As an additional defense layer, enforce the use of a security plugin that sanitizes serialized data or restricts object instantiation. Refer to Patchstack's advisory at https://patchstack.com/database/Wordpress/Theme/halstein/vulnerability/wordpress-halstein-theme-1-8-arbitrary-object-instantiation-vulnerability for vendor guidance and patch availability confirmation.