Skip to main content

Alukas WordPress Theme CVE-2026-39445

HIGH
Deserialization of Untrusted Data (CWE-502)
2026-06-17 Patchstack
8.1
CVSS 3.1 · Vendor: Patchstack
Share

Severity by source

Vendor (Patchstack) PRIMARY
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.1 HIGH

Network-reachable unauthenticated deserialization (AV:N/PR:N/UI:N) but exploitation depends on finding a POP gadget chain, justifying AC:H; successful chain typically yields full C/I/A impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
Analysis Generated
Jun 17, 2026 - 14:36 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Alukas < 3.0.0 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the Alukas WordPress theme (versions prior to 3.0.0) allows remote attackers to inject crafted serialized PHP objects into the application, potentially leading to remote code execution, file manipulation, or full site compromise when a usable POP gadget chain is present. No public exploit identified at time of analysis, and the issue is tracked by Patchstack as a deserialization flaw affecting the presslayouts:alukas product line. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify WordPress site running Alukas < 3.0.0
Delivery
Craft serialized PHP object with POP gadget chain
Exploit
Submit payload to vulnerable theme endpoint
Execution
Trigger unserialize() and magic methods
Persist
Write webshell or execute PHP code
Impact
Full site and database compromise

Vulnerability AssessmentAI

Exploitation Exploitation requires a reachable Alukas theme endpoint that passes attacker-supplied input into PHP unserialize() - typically a public WordPress page, AJAX action, or cookie/parameter handled by the theme prior to version 3.0.0 - and the WordPress installation must expose a usable POP gadget chain (from core, plugins, or other themes) for the deserialized object to produce meaningful impact, which is the reason CVSS marks AC:H. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H scores 8.1 (High) and is consistent with a remotely reachable unauthenticated sink that nonetheless requires a non-trivial gadget chain (AC:H). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An unauthenticated attacker sends an HTTP request to a vulnerable Alukas endpoint with a crafted serialized PHP object designed to trigger a POP gadget chain present in WordPress core or a co-installed plugin. When the theme calls unserialize() on the input, the chain fires during object lifecycle methods and is leveraged to write a PHP webshell into the uploads directory or execute attacker code, yielding full site takeover. …
Remediation Patch available per vendor advisory: upgrade the Alukas theme to version 3.0.0 or later as documented in the Patchstack advisory at https://patchstack.com/database/wordpress/theme/alukas/vulnerability/wordpress-alukas-theme-3-0-0-php-object-injection-vulnerability. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Audit all WordPress installations to identify whether Alukas theme versions prior to 3.0.0 are deployed; immediately disable the theme on non-critical systems pending patch availability. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Share

CVE-2026-39445 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy