What is the CVSS score of CVE-2026-39545?

CVE-2026-39545 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Zermatt WordPress Theme are affected by CVE-2026-39545?

Zermatt WordPress theme versions 1.6.1 and earlier contain an unauthenticated vulnerability that allows remote attackers to inject malicious PHP objects, potentially compromising data…

How to fix or mitigate CVE-2026-39545?

Within 24 hours: Inventory all WordPress installations using Zermatt theme v1.6.1 or earlier; if operationally feasible, deactivate the theme and deploy an alternative. Within 7 days: Implement Web Application Firewall rules to detect and block PHP object deserialization payloads; restrict network access to affected WordPress instances using firewall ACLs and require VPN/IP allowlisting for administration. Within 30 days: Subscribe to Zermatt theme security advisories; upon patch release (monitor vendor channels actively), apply vendor update immediately across all instances before re-enabling the theme.

Zermatt WordPress Theme CVE-2026-39545

EUVD-2026-37673 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization Zermatt

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated deserialization (AV:N/PR:N/UI:N); AC:H reflects required POP gadget chain; full C/I/A impact from typical object-injection RCE outcomes.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:24 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Zermatt <= 1.6.1 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the Zermatt WordPress theme versions 1.6.1 and earlier allows remote attackers to deliver malicious serialized PHP objects to a vulnerable unserialize() sink without prior authentication. Successful exploitation can lead to high impact on confidentiality, integrity, and availability when a suitable POP gadget chain is reachable in the WordPress installation. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

Zermatt is a commercial WordPress theme distributed by Select-Themes (per CPE cpe:2.3:a:select-themes:zermatt). The flaw is a CWE-502 Deserialization of Untrusted Data weakness, meaning attacker-controlled input is passed to PHP's unserialize() (or an equivalent code path) without sufficient validation. In WordPress contexts, such sinks become exploitable when combined with POP (Property-Oriented Programming) gadget chains present in WordPress core, other active plugins, or the theme itself, allowing object instantiation with magic methods (__wakeup, __destruct, __toString) to be abused for file writes, code execution, or arbitrary method calls.

RemediationAI

No vendor-released patch identified at time of analysis from the provided references; site operators should monitor the Select-Themes vendor channel and the Patchstack advisory (https://patchstack.com/database/wordpress/theme/zermatt/vulnerability/wordpress-zermatt-theme-1-6-1-php-object-injection-vulnerability) for an updated theme release beyond 1.6.1 and apply it immediately when available. As compensating controls, deactivate the Zermatt theme and switch to an unaffected theme (side effect: site appearance changes), or place a WAF rule (e.g., Patchstack, Wordfence virtual patch) in front of the site to block requests containing serialized PHP payloads such as parameters starting with 'O:' or 'a:' on theme-handled endpoints (side effect: possible false positives on legitimate serialized data). Additionally, restrict access to any AJAX, REST, or admin-ajax endpoints exposed by the theme to authenticated users only via web server ACLs where feasible (side effect: may break front-end functionality that relies on those endpoints).