What is the CVSS score of CVE-2026-40735?

CVE-2026-40735 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Reina WordPress Theme are affected by CVE-2026-40735?

The Reina WordPress theme (versions 2.1 and earlier) contains an unauthenticated PHP object injection vulnerability (CVSS 8.1) that could enable attackers to execute arbitrary code on affected…

How to fix or mitigate CVE-2026-40735?

Within 24 hours: Inventory all WordPress installations using Reina theme version 2.1 or earlier and immediately disable or remove the theme. Within 7 days: Replace affected theme with an alternative or monitor for patched version release; deploy Web Application Firewall rules to detect object injection attempts. Within 30 days: Conduct forensic security audit of previously affected systems; establish process to track Edge Themes advisories for patch availability and deploy immediately upon release.

Reina WordPress Theme CVE-2026-40735

EUVD-2026-37597 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization Reina

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network-reachable unserialize() sink (AV:N/PR:N/UI:N); AC:H because reliable impact depends on a usable POP gadget chain; full C/I/A impact via arbitrary PHP execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:17 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Reina <= 2.1 versions.

AnalysisAI

Unauthenticated PHP object injection in the Reina WordPress theme (versions 2.1 and earlier) by Edge Themes allows remote attackers to trigger insecure deserialization, potentially leading to arbitrary code execution, data tampering, or denial of service when a suitable PHP gadget chain is present in the WordPress instance. The flaw carries a CVSS 3.1 score of 8.1 (High) with no public exploit identified at time of analysis. The reference from Patchstack confirms the issue but no KEV listing or EPSS data is provided.

Technical ContextAI

The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data) within Reina, a premium commercial WordPress theme distributed by Edge Themes (CPE cpe:2.3:a:edge-themes:reina). PHP Object Injection occurs when user-controlled input is passed into PHP's unserialize() function (or equivalent), allowing an attacker to instantiate arbitrary classes and trigger magic methods such as __wakeup, __destruct, or __toString. In WordPress ecosystems, exploitation typically chains theme/plugin classes with core or third-party 'POP gadgets' (Property-Oriented Programming chains), and tooling such as PHPGGC catalogues many ready-made chains for popular libraries bundled with WordPress.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data; site operators should monitor Edge Themes' ThemeForest/changelog and the Patchstack advisory (https://patchstack.com/database/wordpress/theme/reina/vulnerability/wordpress-reina-theme-2-1-php-object-injection-vulnerability) for an updated Reina release above 2.1 and upgrade immediately when available. As compensating controls until a fix ships, deploy a WordPress WAF (Patchstack, Wordfence, or equivalent) with a virtual patch for this CVE, identify and block the specific theme endpoints or AJAX actions that accept serialized input by restricting access at the web server or via mu-plugin filters, and audit installed plugins to remove known POP gadget sources such as outdated Monolog, Guzzle, or PHPMailer copies - note that disabling theme features may break front-end functionality, and removing bundled libraries can affect plugins relying on them. If the site cannot be patched promptly, consider switching to an alternate theme as a longer-term mitigation.