What is the CVSS score of CVE-2026-39442?

CVE-2026-39442 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of PressMart Theme are affected by CVE-2026-39442?

PressMart WordPress theme versions 1.2.26 and earlier are vulnerable to unauthenticated remote attacks that can result in complete site compromise.

How to fix or mitigate CVE-2026-39442?

Within 24 hours: Inventory all installations of PressMart theme and identify affected versions. Within 7 days: Disable or remove PressMart theme, or contact Patchstack for patch availability timeline and interim guidance. Within 30 days: Deploy alternative theme, implement Web Application Firewall rules to block serialized object payloads, and establish a process for monitoring theme security advisories.

PressMart Theme CVE-2026-39442

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization Pressmart

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated deserialization (AV:N/PR:N/UI:N) with AC:H because reliable exploitation requires a usable POP gadget chain; full H/H/H impact via potential RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:37 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in PressMart <= 1.2.26 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the PressMart WordPress theme versions 1.2.26 and earlier allows remote attackers to deliver malicious serialized payloads that are deserialized by the theme, potentially leading to property-oriented gadget chain abuse and full site compromise. The flaw was disclosed via Patchstack and carries a CVSS 8.1 (AV:N/AC:H/PR:N/UI:N) - no public exploit identified at time of analysis, and the high attack complexity reflects the need for a usable gadget chain to escalate from deserialization to concrete impact.

Technical ContextAI

PressMart is a commercial WordPress theme distributed by PressLayouts (CPE cpe:2.3:a:presslayouts:pressmart). The vulnerability is a CWE-502 Deserialization of Untrusted Data issue in PHP - typically triggered when the theme passes attacker-controlled input to unserialize() (or equivalent), causing PHP to instantiate arbitrary classes and invoke their magic methods (__wakeup, __destruct, __toString). On WordPress, this class is dangerous because the runtime exposes a large universe of plugin/core gadget chains (POP chains) that can be composed into file writes, SQL execution, or RCE even when the theme itself contains no obvious dangerous sinks.

RemediationAI

Upgrade the PressMart theme to a version newer than 1.2.26 as soon as the vendor publishes a fix; consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/presssmart/vulnerability/wordpress-pressmart-theme-1-2-26-php-object-injection-vulnerability for the patched release. Patch available per vendor advisory; a specific fixed version was not included in the supplied data, so verify the exact release on the PressLayouts/ThemeForest changelog before deploying. As compensating controls until patched, deploy a WAF rule (Patchstack/Wordfence virtual patch) to block requests containing serialized PHP markers (e.g. payloads beginning with O:, a:, s:) on theme endpoints, audit and disable any installed plugins known to expose POP gadget chains to reduce exploitability (trade-off: may break dependent functionality), and restrict access to the affected theme entry points via authentication or IP allowlisting where the site's role permits it.