What is the CVSS score of CVE-2026-39539?

CVE-2026-39539 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Alloggio Hotel Booking are affected by CVE-2026-39539?

Alloggio Hotel Booking WordPress theme through version 2.1.2 contains an unauthenticated remote PHP object injection vulnerability (CVE-2026-39539, CVSS 8.1) enabling complete compromise of affected…

How to fix or mitigate CVE-2026-39539?

Within 24 hours: Audit all WordPress instances for Alloggio theme deployment and classify by public exposure. Within 7 days: Remove Alloggio theme entirely or replace with vendor-patched alternative; deploy WAF rules blocking serialized PHP object payloads to vulnerable endpoints. Within 30 days: Enable comprehensive WordPress activity logging and alerting; monitor Patchstack security advisory channel for patch release; conduct log forensics on affected sites for exploitation indicators.

Alloggio Hotel Booking CVE-2026-39539

EUVD-2026-37474 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization Alloggio Hotel Booking

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network-reachable WordPress theme endpoint (AV:N/PR:N/UI:N); AC:H reflects dependency on a usable POP gadget chain; successful object injection typically yields full C/I/A compromise of the site.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:39 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Alloggio - Hotel Booking <= 2.1.2 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the Alloggio - Hotel Booking WordPress theme through version 2.1.2 allows remote attackers to inject crafted serialized objects that, when combined with a suitable gadget chain, can lead to high-impact compromise of the hosting WordPress site. The flaw was reported by Patchstack and is tracked as EUVD-2026-37474; no public exploit identified at time of analysis, and there is no evidence of active exploitation. CVSS 3.1 base score is 8.1 with high attack complexity, reflecting the need for a usable gadget chain in the WordPress environment.

Technical ContextAI

The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data) within the Alloggio - Hotel Booking premium WordPress theme by edge-themes (CPE cpe:2.3:a:edge-themes:alloggio_-_hotel_booking). PHP Object Injection occurs when user-controlled input reaches an unserialize() call (or equivalent), allowing attackers to instantiate arbitrary PHP classes and invoke magic methods such as __wakeup, __destruct, or __toString. In a WordPress context, exploitation typically chains the injected object against POP (Property-Oriented Programming) gadgets present in WordPress core, other active plugins, or bundled libraries, producing effects such as arbitrary file write/read, SQL execution, or remote code execution depending on the available gadget chain.

RemediationAI

Patch available per vendor advisory: upgrade the Alloggio - Hotel Booking theme to a release later than 2.1.2 as published by edge-themes, following the Patchstack advisory at https://patchstack.com/database/wordpress/theme/alloggio/vulnerability/wordpress-alloggio-hotel-booking-theme-2-1-2-php-object-injection-vulnerability; the specific fixed version is not enumerated in the provided data and should be confirmed against the vendor changelog before deployment. Until the site is upgraded, deploy a WAF rule (Patchstack vPatch, Wordfence, or equivalent) to block requests carrying serialized PHP payloads (e.g., parameters matching patterns like O:\d+:" or a:\d+:{) to Alloggio theme endpoints, restrict access to booking/AJAX endpoints to known networks where business workflow permits, and disable or remove the theme on staging or unused sites; note that WAF rules can be bypassed by payload obfuscation and may break legitimate booking submissions, so monitor logs after enabling.