What is the CVSS score of CVE-2026-39445?

CVE-2026-39445 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Alukas WordPress Theme are affected by CVE-2026-39445?

The Alukas WordPress theme (versions prior to 3.0.0) contains an unauthenticated remote code execution vulnerability that enables attackers to inject malicious serialized PHP objects without…

How to fix or mitigate CVE-2026-39445?

Within 24 hours: Audit all WordPress installations to identify whether Alukas theme versions prior to 3.0.0 are deployed; immediately disable the theme on non-critical systems pending patch availability. Within 7 days: Deploy Web Application Firewall (WAF) rules to block PHP object injection payloads; apply all available WordPress core and plugin security updates to reduce available gadget chains. Within 30 days: Monitor Patchstack and vendor advisories for Alukas theme version 3.0.0 patch release; establish timeline for upgrading all affected installations to the patched version once released and security-verified.

Alukas WordPress Theme CVE-2026-39445

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization Alukas

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated deserialization (AV:N/PR:N/UI:N) but exploitation depends on finding a POP gadget chain, justifying AC:H; successful chain typically yields full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:36 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the Alukas WordPress theme (versions prior to 3.0.0) allows remote attackers to inject crafted serialized PHP objects into the application, potentially leading to remote code execution, file manipulation, or full site compromise when a usable POP gadget chain is present. No public exploit identified at time of analysis, and the issue is tracked by Patchstack as a deserialization flaw affecting the presslayouts:alukas product line. Real-world impact depends on the gadget chains available in WordPress core or co-installed plugins.

Technical ContextAI

Alukas is a commercial WordPress theme published by PressLayouts (CPE cpe:2.3:a:presslayouts:alukas). The root cause is CWE-502 (Deserialization of Untrusted Data): the theme passes attacker-controlled input into a PHP unserialize() call (or equivalent), so any class with a magic method such as __wakeup, __destruct, __toString, or __call that is autoloadable in the WordPress runtime can be instantiated with attacker-chosen properties. WordPress and many bundled plugins ship classes that are known POP gadgets, so a deserialization sink in the theme is typically chainable into file writes, SQL, or arbitrary code execution rather than being a self-contained bug.

RemediationAI

Patch available per vendor advisory: upgrade the Alukas theme to version 3.0.0 or later as documented in the Patchstack advisory at https://patchstack.com/database/wordpress/theme/alukas/vulnerability/wordpress-alukas-theme-3-0-0-php-object-injection-vulnerability. Until the upgrade can be applied, place the site behind a WAF (Patchstack, Wordfence, or equivalent) with a rule that blocks serialized PHP payloads (requests containing 'O:' or 'a:' patterns) on the theme endpoints, and audit installed plugins to remove unused components that could supply POP gadget chains; note that aggressive WAF rules can break legitimate cookie or form data that contains serialized blobs, so test in detection mode first. As a heavier control, deactivate the Alukas theme and switch to a default theme until patching is possible, which obviously removes the site's custom presentation.