What is the CVSS score of CVE-2026-39560?

CVE-2026-39560 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Hiroshi Theme are affected by CVE-2026-39560?

The Hiroshi WordPress theme (version 1.5.1 and earlier) contains an unauthenticated PHP object injection vulnerability enabling potential remote code execution.

How to fix or mitigate CVE-2026-39560?

Within 24 hours: Inventory all WordPress instances to identify active deployments of Hiroshi theme version 1.5.1 or earlier. Within 7 days: Disable or immediately replace the vulnerable theme with a patched alternative; deploy Web Application Firewall rules to block malicious serialized PHP payloads in HTTP requests. Within 30 days: Continuously monitor vendor advisories for patch availability and apply immediately upon release.

Hiroshi Theme CVE-2026-39560

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization Hiroshi

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network-reachable theme endpoint (AV:N/PR:N/UI:N); AC:H reflects the gadget-chain precondition typical of PHP object injection, with full CIA impact on the WordPress host.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:34 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Hiroshi <= 1.5.1 versions.

AnalysisAI

Unauthenticated PHP object injection in the Select Themes 'Hiroshi' WordPress theme through version 1.5.1 allows remote attackers to supply crafted serialized payloads that are deserialized by the theme, potentially leading to code execution, file manipulation, or data compromise when a suitable PHP magic-method gadget chain is present in the WordPress stack. The flaw is reachable without authentication per the CVSS vector, and no public exploit has been identified at time of analysis.

Technical ContextAI

The vulnerability is a CWE-502 'Deserialization of Untrusted Data' issue in Hiroshi, a commercial WordPress theme published by Select Themes (CPE cpe:2.3:a:select-themes:hiroshi). PHP object injection occurs when user-controlled input is passed to unserialize() (or an equivalent function) without integrity validation, causing PHP to instantiate arbitrary classes and invoke their magic methods such as __wakeup, __destruct, or __toString. In a WordPress context, an attacker who controls the deserialized object graph can chain into 'POP gadgets' available in WordPress core, other active plugins, or PHPMailer/Requests, which historically have been weaponized into arbitrary file write, SQL injection, or remote code execution. Patchstack, which reported the issue, specializes in WordPress plugin/theme vulnerabilities and tagged this entry with Deserialization, PHP, and Hiroshi, consistent with a classic theme-side unserialize sink.

RemediationAI

No vendor-released patch identified at time of analysis in the supplied data; administrators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/hiroshi/vulnerability/wordpress-hiroshi-theme-1-5-1-php-object-injection-vulnerability for the latest fix status and upgrade to any Hiroshi release newer than 1.5.1 published by Select Themes once available. Until a fixed version is confirmed, compensating controls include deactivating and removing the Hiroshi theme and switching to an unaffected theme (trade-off: site appearance changes), placing a WAF rule in front of WordPress that blocks request parameters containing serialized PHP markers such as values starting with 'O:', 'a:', or 's:' on Hiroshi-handled endpoints (trade-off: may break legitimate features that legitimately pass serialized data and requires endpoint identification from the advisory), and minimizing the available gadget surface by disabling or removing unneeded plugins known to expose POP chains. Monitoring web and PHP error logs for unusual unserialize errors or unexpected class instantiations is recommended as a detection control.