What is the CVSS score of CVE-2026-39554?

CVE-2026-39554 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Fidalgo WordPress Theme are affected by CVE-2026-39554?

Fidalgo WordPress theme versions 1.2.2 and earlier contain an unauthenticated PHP Object Injection vulnerability (CVSS 8.1) enabling remote code execution on affected websites.

How to fix or mitigate CVE-2026-39554?

24 hours: Audit all WordPress installations to identify Fidalgo theme deployment and versions; document scope and determine business criticality of affected systems. 7 days: Deploy Web Application Firewall rules to block serialized PHP object patterns; for mission-critical sites, disable the theme and deploy alternative until patch available. 30 days: Contact vendor for patch timeline estimate; if no resolution path, execute full theme replacement and conduct security assessment of compromised systems.

Fidalgo WordPress Theme CVE-2026-39554

EUVD-2026-37478 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization Fidalgo

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable theme endpoint with no auth or user interaction (AV:N/PR:N/UI:N); AC:H because reliable RCE depends on an available PHP gadget chain in the deployed stack; full C/I/A impact on the WordPress site.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:37 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Fidalgo <= 1.2.2 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the Fidalgo WordPress theme (versions ≤1.2.2) allows remote attackers to inject crafted serialized PHP objects that are deserialized by the theme, potentially leading to arbitrary code execution, data tampering, or service disruption depending on available gadget chains. No public exploit identified at time of analysis, but the unauthenticated network vector and CWE-502 classification make this a meaningful risk for WordPress sites running this commercial theme.

Technical ContextAI

The Fidalgo theme, distributed by Elated Themes (per the CPE elated-themes:fidalgo), is a commercial WordPress theme. The root cause is CWE-502 (Deserialization of Untrusted Data), where attacker-controlled input is passed into PHP's unserialize() or an equivalent sink without validation. In WordPress themes this typically occurs in AJAX handlers, REST endpoints, or option/meta processing that accept user-supplied data. PHP object injection becomes critical when the WordPress runtime (core, plugins, or theme itself) provides 'magic method' gadget chains (e.g., __wakeup, __destruct) that can be abused for file writes, SQL execution, or arbitrary code execution. The vulnerability was disclosed by Patchstack, which curates WordPress plugin/theme vulnerabilities.

RemediationAI

No vendor-released patch identified at time of analysis from the supplied data; site operators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/fidalgo/vulnerability/wordpress-fidalgo-theme-1-2-2-php-object-injection-vulnerability and the Elated Themes vendor channel for an updated theme release above 1.2.2 and apply it as soon as it is published. Until a fixed version is available, consider deactivating the Fidalgo theme and switching to a safe default theme (accepting visual/functional disruption), placing the site behind a WAF such as Patchstack, Wordfence, or Cloudflare with rules that block serialized PHP payloads (patterns like O:\d+: and a:\d+:{) on theme endpoints, and removing or restricting access to vulnerable AJAX/REST endpoints exposed by the theme - noting this may break legitimate theme features. Audit installed plugins for known PHP object-injection gadget chains (e.g., older versions of common plugins) and remove or update them to reduce exploitability.