What is the CVSS score of CVE-2026-39576?

CVE-2026-39576 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of SingleMalt WordPress Theme are affected by CVE-2026-39576?

The SingleMalt WordPress theme (versions 1.5 and earlier) contains an unauthenticated PHP object injection vulnerability (CVSS 8.1) that exposes all affected WordPress installations to remote…

How to fix or mitigate CVE-2026-39576?

Within 24 hours: Inventory all WordPress installations and identify those using SingleMalt theme versions 1.5 or earlier. Within 7 days: Either disable the SingleMalt theme entirely and activate an alternative, or if an updated version becomes available, immediately update to the latest patched release. Within 30 days: Implement ongoing vulnerability scanning for WordPress themes and plugins, and establish automated patching procedures to accelerate deployment of future security updates.

SingleMalt WordPress Theme CVE-2026-39576

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization Singlemalt

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Theme endpoint reachable over network without authentication or user interaction; AC:H because reliable RCE requires a usable PHP POP gadget chain; full CIA impact via deserialization to code execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:34 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in SingleMalt <= 1.5 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the SingleMalt WordPress theme (versions up to and including 1.5) allows remote attackers to deserialize attacker-controlled data, which can lead to compromise of confidentiality, integrity, and availability of affected WordPress sites. The flaw is exploitable without authentication or user interaction but has high attack complexity per its CVSS vector, and no public exploit identified at time of analysis.

Technical ContextAI

SingleMalt is a commercial WordPress theme distributed by elated-themes (CPE: cpe:2.3:a:elated-themes:singlemalt). The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data) - specifically PHP Object Injection, where untrusted input reaches PHP's unserialize() function or an equivalent sink. When attacker-controlled serialized data is deserialized, PHP magic methods (__wakeup, __destruct, __toString) on resulting objects can be invoked, and when chained with classes loaded by WordPress core, other plugins, or the theme itself, this can form a POP (Property-Oriented Programming) gadget chain leading to arbitrary code execution, file operations, or SQL queries. WordPress themes commonly expose deserialization sinks through AJAX handlers, custom shortcodes, cookie parsing, or option storage.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data - administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/singlemalt/vulnerability/wordpress-singlemalt-theme-1-5-php-object-injection-vulnerability) and the elated-themes vendor portal for an updated SingleMalt release above 1.5 and apply it as soon as published. Until a fixed version is available, compensating controls include switching the active theme to a maintained alternative (eliminates the attack surface but breaks site appearance and may require re-theming work), placing the site behind a WAF such as Patchstack, Wordfence, or Cloudflare with rules that block serialized PHP payloads (regex patterns such as O:\d+:" or a:\d+:{) in query, body, and cookie parameters (may produce false positives on legitimate serialized cookies), and restricting access to theme AJAX endpoints and admin-ajax.php actions registered by the theme via web-server ACLs where the site does not require public access to them.