What is the CVSS score of CVE-2026-40736?

CVE-2026-40736 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Laurits Theme are affected by CVE-2026-40736?

The Laurits WordPress theme (through version 1.5.1) contains an unauthenticated PHP object injection vulnerability enabling remote code execution and data tampering across all affected websites.

How to fix or mitigate CVE-2026-40736?

Within 24 hours: Identify all WordPress instances running Laurits theme versions ≤1.5.1 and immediately deactivate the theme in production. Within 7 days: Audit access logs for exploitation attempts and procure a replacement WordPress theme with documented security practices. Within 30 days: Migrate all affected websites to alternative theme or implement isolated environment if replacement is infeasible; document theme inventory controls to prevent future supply-chain gaps.

Laurits Theme CVE-2026-40736

EUVD-2026-37485 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization Laurits

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated injection (AV:N/PR:N/UI:N) with AC:H for required gadget-chain discovery; successful deserialization to RCE yields full C/I/A impact on the WordPress host.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:33 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Laurits <= 1.5.1 versions.

AnalysisAI

Unauthenticated PHP object injection in the Laurits WordPress theme through version 1.5.1 allows remote attackers to deserialize attacker-controlled data, potentially leading to code execution, data tampering, or denial of service when a suitable gadget chain is present in the WordPress stack. The flaw was disclosed via Patchstack and tracked as EUVD-2026-37485; no public exploit identified at time of analysis, though the high CVSS of 8.1 and CWE-502 classification mark it as a serious supply-chain risk for sites running this commercial Edge-Themes product.

Technical ContextAI

Laurits is a commercial WordPress theme published by Edge-Themes (CPE cpe:2.3:a:edge-themes:laurits) that, like many premium themes, ships custom AJAX, import, or settings handlers in PHP. The root cause class is CWE-502 (Deserialization of Untrusted Data): the theme passes attacker-supplied input into PHP's unserialize() (or an equivalent sink such as maybe_unserialize on raw request data) without integrity checks. Because WordPress core and bundled plugins expose many magic methods (__wakeup, __destruct, __toString) on classes loaded at runtime, an injected serialized payload can pivot through one of these POP (property-oriented programming) gadget chains to reach dangerous sinks like file writes, SQL, or system command execution.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data; consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/laurits/vulnerability/wordpress-laurits-theme-1-5-1-php-object-injection-vulnerability for the fixed version and upgrade Laurits to that release as soon as Edge-Themes publishes it. Until a patch is installed, place the site behind a WAF such as Patchstack, Wordfence, or Cloudflare with virtual-patching rules that block requests containing PHP serialized object markers (e.g. 'O:' followed by a class name and length, or 'a:' arrays embedding objects) on theme endpoints, accepting the trade-off of occasional false positives on legitimate base64 or JSON payloads. As compensating controls, restrict access to wp-admin and theme AJAX endpoints by IP, disable or remove the Laurits theme on staging and unused multisite subsites, and audit installed plugins to identify and remove any that expose well-known POP gadget chains (e.g. older Monolog, Guzzle, or PHPMailer bundles) that could be reached through the deserialization sink.