What is the CVSS score of CVE-2026-39550?

CVE-2026-39550 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Aperitif WordPress Theme are affected by CVE-2026-39550?

The Aperitif WordPress theme (versions 1.6 and earlier) contains a critical vulnerability that allows remote attackers to execute arbitrary code and fully compromise affected websites.

How to fix or mitigate CVE-2026-39550?

Within 24 hours: Scan all WordPress environments to identify Aperitif theme installations version 1.6 or earlier and classify by business criticality. Within 7 days: Deploy Web Application Firewall rules blocking PHP object injection patterns; restrict administrative access to theme configuration; disable theme features on non-critical sites; escalate patch request to Elated-Themes with severity classification. Within 30 days: Monitor Elated-Themes security advisories for patch release; plan migration to alternative theme or patched version; conduct incident response assessment if exploitation indicators are detected.

Aperitif WordPress Theme CVE-2026-39550

EUVD-2026-33911 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-02 Patchstack

GHSA-4mp4-954f-p5jr

Deserialization Aperitif

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 11:51 vuln.today

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Elated-Themes Aperitif allows Object Injection.

This issue affects Aperitif: from n/a through 1.6.

AnalysisAI

Object injection in the Elated-Themes Aperitif WordPress theme through version 1.6 allows remote attackers to trigger PHP deserialization of attacker-controlled data, potentially leading to code execution, file manipulation, or full site compromise when a suitable gadget chain is present. CVSS 8.1 reflects high impact across confidentiality, integrity, and availability, though attack complexity is rated High. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

Aperitif is a commercial WordPress theme distributed by Elated-Themes (CPE cpe:2.3:a:elated-themes:aperitif). The root cause is CWE-502 (Deserialization of Untrusted Data): PHP's unserialize() is invoked on input that traverses a trust boundary, allowing an attacker to instantiate arbitrary PHP objects. In WordPress themes, this typically arises from passing user-supplied values (cookies, request parameters, post meta, options, or AJAX payloads) directly to unserialize(), and exploitation chains usually leverage 'POP' (Property-Oriented Programming) gadgets present in WordPress core, bundled plugins, or other themes to convert the object instantiation into file writes, SQL operations, or RCE. Patchstack, who reported the issue, classifies this as PHP Object Injection in the Aperitif theme.

RemediationAI

No vendor-released patched version is identified in the available data - the advisory states the issue affects Aperitif 'from n/a through 1.6' without naming a fixed release. Administrators should monitor the Patchstack advisory (https://patchstack.com/database/wordpress/theme/aperitif/vulnerability/wordpress-aperitif-theme-1-6-php-object-injection-vulnerability) and the Elated-Themes vendor portal for an updated theme build and upgrade immediately when released. In the interim, deploy a WordPress WAF (Patchstack, Wordfence, or equivalent) with virtual-patching rules covering this CVE, audit and remove the Aperitif theme on sites where it is inactive (deactivation alone may not unload theme PHP if directly requested), restrict access to theme-shipped PHP endpoints at the web-server layer, and keep WordPress core and all plugins fully updated to reduce the availability of POP gadget chains. Trade-off: WAF rules can be bypassed by encoding tricks and theme removal will break sites that depend on Aperitif for rendering, so a maintenance window for theme replacement may be required.