What is the CVSS score of CVE-2026-32512?

CVE-2026-32512 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Pelicula are affected by CVE-2026-32512?

A critical PHP object injection vulnerability in Edge-Themes Pelicula theme (versions prior to 1.10) allows unauthenticated attackers to inject malicious objects through insecure deserialization,…. A patch is available.

How to fix or mitigate CVE-2026-32512?

Within 24 hours: Identify all WordPress installations using Pelicula theme and document current versions. Within 7 days: Update Pelicula to version 1.10 or later via WordPress admin dashboard or direct download from Edge-Themes. Verify update completion and restart WordPress. Within 30 days: Conduct post-incident review of access logs for suspicious deserialization activity between discovery and patching; review user permissions and disable unused administrative accounts.

Pelicula CVE-2026-32512

EUVD-2026-15868 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

GHSA-w68h-wpmm-q4p8

Deserialization Pelicula

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 05:48 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

1.10

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15868

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Edge-Themes Pelicula pelicula-video-production-and-movie-theme allows Object Injection.This issue affects Pelicula: from n/a through < 1.10.

AnalysisAI

A PHP object injection vulnerability exists in the Edge-Themes Pelicula video production and movie theme due to insecure deserialization of untrusted data, classified as CWE-502. The vulnerability affects Pelicula versions prior to 1.10, allowing attackers to inject arbitrary objects and potentially achieve remote code execution or other malicious outcomes. No CVSS score or EPSS data has been published, and no confirmed KEV or active exploitation in the wild has been reported, but the nature of object injection vulnerabilities typically enables high-impact attacks when paired with accessible gadget chains in the WordPress ecosystem.

Technical ContextAI

This vulnerability stems from unsafe PHP unserialization (CWE-502) within the Pelicula WordPress theme developed by Edge-Themes. The theme, identified by CPE cpe:2.3:a:edge-themes:pelicula:*:*:*:*:*:*:*:*, likely processes user-supplied input or stored data through PHP's unserialize() function without proper validation. In object injection attacks, attackers craft malicious serialized PHP objects that, when unserialized, trigger the instantiation of arbitrary classes and invoke magic methods (__wakeup, __destruct, __toString, etc.). These methods can chain through available WordPress plugins and themes to reach dangerous functions like eval(), system(), or file write operations. The attack does not require a complex exploit chain if vulnerable gadgets exist in the WordPress installation.

RemediationAI

Upgrade the Pelicula theme to version 1.10 or later immediately by accessing the WordPress admin dashboard, navigating to Appearance > Themes, and clicking the update button if available, or by downloading the patched version directly from the Edge-Themes website or WordPress.org theme repository. Until patching is feasible, implement WordPress security hardening: restrict theme and plugin editing by setting define('DISALLOW_FILE_EDIT', true) in wp-config.php, disable file uploads to non-admin users, enforce strong administrator credentials, and use a WordPress security plugin (e.g., Wordfence, Sucuri) with intrusion detection rules for PHP object injection attempts. Monitor the Patchstack vulnerability database and WordPress security mailing lists for additional guidance. See the Patchstack vulnerability report at https://patchstack.com/database/Wordpress/Theme/pelicula-video-production-and-movie-theme/vulnerability/wordpress-pelicula-theme-1-10-php-object-injection-vulnerability for further details.