What is the CVSS score of CVE-2026-39567?

CVE-2026-39567 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Santé Theme are affected by CVE-2026-39567?

The Santé WordPress theme (Select Themes commercial product, through version 1.5.1) contains an unauthenticated remote code execution vulnerability that exposes any website running this theme to…

How to fix or mitigate CVE-2026-39567?

Within 24 hours: Audit all WordPress installations for Santé theme version 1.5.1 or earlier; document criticality and dependencies. Within 7 days: Disable the Santé theme on all instances (deploy temporary alternative theme if operationally required); contact Select Themes for remediation timeline. Within 30 days: Replace with alternative theme or apply vendor patch immediately upon release; re-enable only after security update confirmed.

Santé Theme CVE-2026-39567

EUVD-2026-37480 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization Sant

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network-reachable PHP object injection (AV:N, PR:N, UI:N) with high impact across CIA via gadget-chain RCE; AC:H reflects dependence on a viable POP chain.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:36 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Santé <= 1.5.1 versions.

AnalysisAI

Unauthenticated PHP object injection in the Santé WordPress theme through version 1.5.1 allows remote attackers to deserialize attacker-controlled data and potentially achieve remote code execution, data tampering, or denial of service when a suitable POP gadget chain is present. The flaw is reported by Patchstack and tracked as EUVD-2026-37480; no public exploit identified at time of analysis, and the CVSS 8.1 score reflects high attack complexity offset by network reach and no authentication. The Santé theme is a commercial Select Themes product, so exposure is limited to sites that have installed and activated this specific theme.

Technical ContextAI

The vulnerability is a CWE-502 Deserialization of Untrusted Data issue in the Santé WordPress theme (CPE cpe:2.3:a:select-themes:santé). PHP object injection occurs when user-controlled input reaches PHP's unserialize() function (or equivalent), allowing an attacker to instantiate arbitrary classes and trigger their magic methods such as __wakeup, __destruct, or __toString. On WordPress, the impact typically depends on POP (Property-Oriented Programming) gadget chains present in WordPress core, the active plugins, or the theme itself - chains in the broader plugin ecosystem have historically enabled file write, SQL injection, and remote code execution from a single injection sink.

RemediationAI

No vendor-released patch identified at time of analysis from the supplied data; site owners should consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/sante/vulnerability/wordpress-sante-theme-1-5-1-php-object-injection-vulnerability) for the latest fixed version and upgrade Santé to a release greater than 1.5.1 once published by Select Themes. In the interim, restrict access to the vulnerable endpoint via a WordPress WAF rule (Patchstack, Wordfence, or equivalent virtual patch) targeting serialized PHP payloads in the affected request parameters, which trades some flexibility in theme features that legitimately send serialized data for protection against the injection sink; deactivating the Santé theme and switching to a default WordPress theme fully eliminates exposure at the cost of losing the site's current design.