What is the CVSS score of CVE-2026-39573?

CVE-2026-39573 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Mildhill WordPress Theme are affected by CVE-2026-39573?

WordPress sites using Select Themes Mildhill theme version 1.5 or earlier face a critical unauthenticated vulnerability (CVSS 8.1) that could enable remote attackers to compromise websites and access…

How to fix or mitigate CVE-2026-39573?

Within 24 hours: Scan all WordPress instances to identify those running Mildhill theme version 1.5 or earlier; document affected sites and their business criticality. Within 7 days: Either disable/remove the theme, deploy WAF rules to block exploitation attempts, or implement network-level access controls; contact Select Themes for patch timeline and subscribe to Patchstack for updates. Within 30 days: Migrate all remaining instances to a patched version once available, or confirm successful remediation using alternative themes across all affected deployments.

Mildhill WordPress Theme CVE-2026-39573

EUVD-2026-37676 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization Mildhill

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated WordPress theme endpoint (AV:N, PR:N, UI:N); practical PHP object injection needs a POP gadget chain, justifying AC:H; deserialization typically yields full C/I/A impact on the site.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:22 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Mildhill <= 1.5 versions.

AnalysisAI

Unauthenticated PHP Object Injection affects the Select Themes Mildhill WordPress theme in versions 1.5 and earlier, allowing remote attackers to inject crafted serialized PHP objects that the application deserializes without validation. Successful exploitation can yield high confidentiality, integrity, and availability impact on the underlying WordPress site, typically by chaining the injected object with a POP gadget present in the theme, WordPress core, or another installed plugin. No public exploit identified at time of analysis, and the issue is reported via Patchstack rather than the CISA KEV catalog.

Technical ContextAI

Mildhill is a commercial premium WordPress theme published by Select Themes (CPE cpe:2.3:a:select-themes:mildhill). The root cause is CWE-502 Deserialization of Untrusted Data: the theme passes attacker-controlled input into a PHP unserialize() (or equivalent) call without first validating the structure or origin of the data. In PHP, deserializing attacker-controlled strings instantiates arbitrary classes and triggers magic methods such as __wakeup, __destruct, and __toString, which is the canonical primitive for property-oriented programming (POP) gadget chains. In a WordPress context the gadget pool is large because every active plugin, theme, and core class contributes potentially abusable methods, which is why object injection in themes is treated as a serious class of vulnerability even when the theme itself contains no obvious sink.

RemediationAI

No vendor-released patch identified at time of analysis; the only reference is the Patchstack advisory at https://patchstack.com/database/wordpress/theme/mildhill/vulnerability/wordpress-mildhill-theme-1-5-php-object-injection-vulnerability, which does not list a fixed version in the provided data, so site operators should check Select Themes (ThemeForest/Qode Interactive) for an updated Mildhill release greater than 1.5 and upgrade as soon as one is published. Until a fix is available, the most effective compensating controls are deactivating and removing the Mildhill theme and switching to an unaffected theme, or placing the site behind a WAF such as Patchstack, Wordfence, or Cloudflare with rules that block serialized PHP payloads (requests containing tokens like O:, a:, or s: in user-controllable parameters); note that WAF rules can produce false positives on legitimate serialized cookies or admin traffic. Additionally, audit installed plugins and themes to reduce the available POP gadget pool, disable unused plugins, and consider PHP-level hardening such as setting disable_classes or using suhosin-style filters, accepting that this may break legitimate plugin functionality.