What is the CVSS score of CVE-2026-32510?

CVE-2026-32510 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Kamperen are affected by CVE-2026-32510?

CVE-2026-32510 presents moderate security risk, a insecure deserialization vulnerability rated CVSS 5.4. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-32510?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Kamperen CVE-2026-32510

EUVD-2026-15864 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-g86r-3x4w-vj28

Deserialization Kamperen

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.3

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15864

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

MEDIUM 5.4

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Edge-Themes Kamperen kamperen allows Object Injection.This issue affects Kamperen: from n/a through < 1.3.

AnalysisAI

A deserialization of untrusted data vulnerability exists in Edge-Themes Kamperen WordPress theme versions prior to 1.3, allowing attackers to perform arbitrary object instantiation through object injection attacks. This CWE-502 vulnerability enables remote code execution or information disclosure without requiring authentication in many scenarios. While no CVSS score is currently published and KEV/EPSS data are unavailable, the vulnerability has been reported by Patchstack and affects all installations of the Kamperen theme below version 1.3.

Technical ContextAI

The vulnerability resides in the Kamperen WordPress theme (identified via CPE cpe:2.3:a:edge-themes:kamperen:*:*:*:*:*:*:*:*), which improperly deserializes user-supplied data without proper validation. This is a classic CWE-502 (Deserialization of Untrusted Data) weakness, commonly found in PHP applications that use unserialize() on untrusted input or equivalent unsafe deserialization mechanisms. Object injection occurs when an attacker crafts malicious serialized objects that, upon unserialization, instantiate arbitrary classes available in the WordPress environment, potentially triggering __wakeup() or __destruct() magic methods to execute attacker-controlled code. WordPress themes are particularly sensitive to such flaws because they run with site administrator privileges and have access to the WordPress core API.

RemediationAI

Immediately upgrade the Kamperen theme to version 1.3 or later through the WordPress theme administration panel or via direct download from the Edge-Themes vendor. Site administrators should verify the update is applied by checking Settings > General or using the WordPress command-line tool (wp theme list). As an interim control, disable the Kamperen theme and switch to an alternative theme if upgrading is delayed. Additionally, implement WordPress security hardening by: installing a Web Application Firewall (WAF) such as Wordfence or Sucuri to detect and block serialized object payloads; applying the principle of least privilege to file permissions (especially wp-content/themes/kamperen/); and enabling WordPress security monitoring to detect suspicious deserialization activity. Site owners should verify no backdoors were installed by checking for unauthorized user accounts and reviewing file modification timestamps in the theme directory.