What is the CVSS score of CVE-2026-32511?

CVE-2026-32511 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of St L are affected by CVE-2026-32511?

Organizations using Deserialization of Untrusted Data vulnerability in Mikado-Themes Stål stal should be aware of moderate risk from CVE-2026-32511, a insecure deserialization vulnerability rated…. A patch is available.

How to fix or mitigate CVE-2026-32511?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

St L CVE-2026-32511

EUVD-2026-15866 MEDIUM

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-r6hw-pm67-r37m

Deserialization St L

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

1.7

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15866

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

MEDIUM 5.4

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Mikado-Themes Stål stal allows Object Injection.This issue affects Stål: from n/a through < 1.7.

AnalysisAI

A deserialization of untrusted data vulnerability exists in Mikado-Themes Stål (a WordPress theme) that allows arbitrary object injection through unsafe unserialize() operations. Versions prior to 1.7 are affected. An attacker can exploit this to instantiate arbitrary PHP objects, potentially leading to remote code execution, data exfiltration, or site compromise depending on available gadget chains in the WordPress environment.

Technical ContextAI

The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data), a critical class of PHP vulnerabilities where user-controlled input is passed to PHP's unserialize() function without proper validation. The affected product is the Stål WordPress theme (CPE: cpe:2.3:a:mikado-themes:stål:*:*:*:*:*:*:*:*), which handles serialized PHP objects from untrusted sources. This is common in WordPress theme options, POST data, or COOKIE values. An attacker crafts a malicious serialized object string containing a gadget chain (a sequence of existing PHP classes with magic methods like __wakeup() or __destruct()) to achieve code execution or other malicious objectives without invoking unserialize() validation or leveraging filter_var() checks.

RemediationAI

Immediately upgrade Mikado-Themes Stål to version 1.7 or later to remediate the arbitrary object injection vulnerability. Site administrators should apply this patch without delay via the WordPress theme update mechanism or by downloading directly from the Mikado-Themes repository. Until patching is feasible, implement network-level access controls to restrict theme administrative functions, disable the theme if not actively in use, and monitor PHP error logs for unserialize() warnings. Consider installing a Web Application Firewall (WAF) rule to detect or block serialized object payloads in HTTP requests. For additional details and verification, consult the Patchstack vulnerability database entry at https://patchstack.com/database/Wordpress/Theme/stal/vulnerability/wordpress-staal-theme-1-7-arbitrary-object-instantiation-vulnerability.