What is the CVSS score of CVE-2026-32509?

CVE-2026-32509 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Gracey are affected by CVE-2026-32509?

Organizations using Deserialization of Untrusted Data vulnerability in Edge-Themes Gracey gracey should be aware of moderate risk from CVE-2026-32509, a insecure deserialization vulnerability rated…. A patch is available.

How to fix or mitigate CVE-2026-32509?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Gracey CVE-2026-32509

EUVD-2026-15863 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-rgvc-fqr7-3hvm

Deserialization Gracey

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.4

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15863

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

MEDIUM 5.4

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Edge-Themes Gracey gracey allows Object Injection.This issue affects Gracey: from n/a through < 1.4.

AnalysisAI

A deserialization of untrusted data vulnerability exists in Edge-Themes Gracey WordPress theme versions prior to 1.4, allowing attackers to perform arbitrary object instantiation through object injection attacks. This CWE-502 vulnerability affects all installations of Gracey below version 1.4 and could enable remote code execution or other malicious actions depending on available gadget chains in the WordPress environment. No CVSS score, EPSS risk metric, or KEV status has been publicly assigned, but the vulnerability is documented by Patchstack with a patch available in version 1.4.

Technical ContextAI

This vulnerability stems from unsafe deserialization of user-supplied data in the Gracey WordPress theme (CPE: cpe:2.3:a:edge-themes:gracey:*:*:*:*:*:*:*:*), which falls under CWE-502 (Deserialization of Untrusted Data). The root cause involves improper handling of serialized PHP objects or similar data structures without adequate validation before instantiation. In WordPress themes, this typically occurs when unserialized user input is passed directly to object constructors or magic methods such as __wakeup(), __destruct(), or __toString(). Attackers can craft malicious serialized payloads that trigger gadget chains—sequences of existing classes with magic methods—to achieve object injection and potentially escalate to code execution.

RemediationAI

Immediately upgrade the Edge-Themes Gracey theme to version 1.4 or later through the WordPress theme update mechanism or by downloading directly from the vendor. Verify the upgrade is successful by checking the theme version in wp-admin > Appearance > Themes. Until patching is complete, consider disabling the Gracey theme temporarily and activating a patched alternative theme. Additionally, implement WordPress security hardening practices such as keeping WordPress core and all plugins up-to-date, restricting administrative access via IP whitelisting, and deploying a Web Application Firewall (WAF) with rules to detect and block serialized object payloads. Monitor logs for suspicious deserialization attempts or unexpected object instantiation errors.