What is the CVSS score of CVE-2026-39580?

CVE-2026-39580 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Micdrop WordPress Theme are affected by CVE-2026-39580?

The Micdrop WordPress theme (versions 1.3.1 and earlier) contains a critical object injection vulnerability allowing unauthenticated remote attackers to compromise website confidentiality, integrity,…

How to fix or mitigate CVE-2026-39580?

Within 24 hours: Identify all sites using Micdrop theme version 1.3.1 or earlier and assess business criticality. Within 7 days: Disable the vulnerable theme on all production and non-production instances, and begin formal migration planning to alternative WordPress themes with active security support. Within 30 days: Complete migration to patched or alternative themes and validate WordPress core and all plugins are updated to versions supporting CWE-502 mitigation.

Micdrop WordPress Theme CVE-2026-39580

EUVD-2026-37484 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization Micdrop

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated unserialize() (AV:N/PR:N/UI:N); AC:H because impact depends on a usable POP gadget chain; full CIA impact typical of object injection leading to RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:34 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Micdrop <= 1.3.1 versions.

AnalysisAI

PHP Object Injection in the Micdrop WordPress theme versions 1.3.1 and earlier allows remote unauthenticated attackers to trigger insecure deserialization, potentially leading to high impact on confidentiality, integrity, and availability of the underlying site. No public exploit identified at time of analysis, and the CVSS vector reflects high attack complexity, meaning successful exploitation likely depends on the presence of a usable PHP gadget chain in the site's installed plugins or core. The flaw is tracked as CWE-502 (Deserialization of Untrusted Data) and was reported by Patchstack.

Technical ContextAI

Micdrop is a commercial WordPress theme distributed by Select Themes, identified by CPE cpe:2.3:a:select-themes:micdrop. The vulnerability falls under CWE-502, Deserialization of Untrusted Data: untrusted input is passed to PHP's unserialize() (or an equivalent routine), allowing attacker-controlled serialized objects to instantiate classes whose magic methods (__wakeup, __destruct, __toString, etc.) execute during unserialization. In WordPress ecosystems, such object injection becomes dangerous when combined with 'POP' (Property-Oriented Programming) gadget chains exposed by WordPress core, popular plugins, or other themes loaded in the same request, which can escalate the primitive into file writes, SQL execution, or remote code execution. Patchstack categorizes this under their PHP/Deserialization tag, consistent with the broader class of WordPress theme/plugin object injection issues.

RemediationAI

No vendor-released patch identified at time of analysis; the input does not cite a fixed Micdrop version, so administrators should monitor the Patchstack advisory (https://patchstack.com/database/wordpress/theme/micdrop/vulnerability/wordpress-micdrop-theme-1-3-1-php-object-injection-vulnerability) and Select Themes for an update beyond 1.3.1 and apply it as soon as available. In the interim, compensating controls include deploying a WAF with rules that block PHP serialized payload patterns (e.g., 'O:<digits>:"' and 'a:<digits>:{') on theme-handled endpoints - accepting the trade-off of potential false positives on legitimate serialized cookies - auditing and removing any unused plugins/themes that could supply POP gadget chains, restricting access to the theme's vulnerable endpoints via IP allowlisting or authentication at the web server layer, and ensuring PHP error display is disabled to limit reconnaissance. If the theme is non-essential, switching to an alternative theme is the most decisive mitigation.