What is the CVSS score of CVE-2026-40733?

CVE-2026-40733 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of ShiftUp WordPress Theme are affected by CVE-2026-40733?

ShiftUp WordPress theme version 1.3 and earlier contains an unauthenticated remote code execution vulnerability through PHP object injection that could allow attackers to take complete control of…

How to fix or mitigate CVE-2026-40733?

24 hours: Audit all WordPress installations for ShiftUp theme ≤1.3; request patch timeline from Mikado Themes; deploy Web Application Firewall rules to block PHP serialization payloads. 7 days: If patch released, deploy to staging environment for validation before production; if no patch, prepare contingency theme replacement and implement all available compensating controls. 30 days: Complete full remediation across production-either deploy patched version or migrate to alternative theme; document all interim controls and disable legacy theme configurations.

ShiftUp WordPress Theme CVE-2026-40733

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization Shiftup

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated WordPress theme endpoint (AV:N/PR:N/UI:N); AC:H because reliable RCE needs a working POP gadget chain in the loaded class set; full CIA impact via object injection.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:32 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in ShiftUp <= 1.3 versions.

AnalysisAI

Unauthenticated PHP object injection in the Mikado Themes ShiftUp WordPress theme (versions ≤ 1.3) allows remote attackers to pass attacker-controlled serialized data into a PHP unserialize() sink, potentially triggering gadget chains that can lead to remote code execution, data tampering, or site takeover. CVSS is rated 8.1 with high attack complexity but no privileges or user interaction required, and no public exploit identified at time of analysis. The issue was disclosed via Patchstack.

Technical ContextAI

ShiftUp is a commercial WordPress theme distributed by Mikado-Themes (CPE cpe:2.3:a:mikado-themes:shiftup). The root cause is CWE-502 (Deserialization of Untrusted Data): PHP code somewhere in the theme calls unserialize() on input that an unauthenticated visitor can influence. In a WordPress context this typically intersects with magic methods (__wakeup, __destruct, __toString) in either the theme, bundled plugins, or core/WordPress libraries, which can be chained into 'POP' (property-oriented programming) gadget chains. Because WordPress installations frequently load many additional plugins that register classes at request time, the practical impact of an object-injection sink usually escalates to file write or RCE rather than staying confined to logic abuse.

RemediationAI

Upstream fix status from the supplied data is unclear - Patchstack lists versions ≤ 1.3 as vulnerable but no fixed version is named, so treat this as 'No vendor-released patch identified at time of analysis' pending confirmation from Mikado-Themes; check the Patchstack advisory (https://patchstack.com/database/wordpress/theme/shiftup/vulnerability/wordpress-shiftup-theme-1-3-php-object-injection-vulnerability) and the ThemeForest/Mikado-Themes vendor page for a release after 1.3 and upgrade as soon as one is published. As compensating controls until then, deploy a WAF rule (Patchstack, Wordfence, or equivalent) that blocks requests containing serialized PHP payload markers such as 'O:' or 'a:' in query/body parameters reaching theme endpoints - accepting that this may false-positive on legitimate serialized cookies; restrict access to the theme's AJAX/REST handlers via web-server ACLs if the affected endpoint is known from the advisory; and audit installed plugins to remove unused ones that could contribute gadget chains, noting that this only reduces, not eliminates, exploitability.