What is the CVSS score of CVE-2026-40738?

CVE-2026-40738 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Eldon WordPress Theme are affected by CVE-2026-40738?

Organizations deploying the Eldon WordPress theme (versions 1.4.1 and earlier) face immediate risk of site compromise through remote code execution.

How to fix or mitigate CVE-2026-40738?

Within 24 hours: Inventory all WordPress instances using Eldon theme version 1.4.1 or earlier. Within 7 days: Implement WAF rules to block serialized object payloads; disable or isolate the Eldon theme on public-facing sites; review access logs for exploitation attempts. Within 30 days: Monitor Edge-Themes security advisories for patch availability; perform integrity audits on affected sites; document remediation completion.

Eldon WordPress Theme CVE-2026-40738

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization Eldon

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable WordPress theme endpoint, no auth or user interaction; AC:H reflects required POP gadget chain; successful unserialize-driven RCE compromises C/I/A fully within the PHP process scope.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:31 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Eldon <= 1.4.1 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the Eldon WordPress theme (versions <= 1.4.1) by Edge-Themes allows remote attackers to inject arbitrary PHP objects through unsafe deserialization, potentially leading to remote code execution, data theft, or site compromise when a suitable POP gadget chain is present in the WordPress environment. No public exploit identified at time of analysis, and Patchstack rates this CVSS 8.1 (High) with high attack complexity reflecting the need for a usable gadget chain.

Technical ContextAI

Eldon is a commercial WordPress theme distributed by Edge-Themes, identified by CPE cpe:2.3:a:edge-themes:eldon. The flaw is rooted in CWE-502 (Deserialization of Untrusted Data): the theme passes attacker-controlled input into PHP's unserialize() without validating the data, causing PHP to instantiate arbitrary classes and invoke their magic methods (__wakeup, __destruct, __toString). In WordPress, exploitation typically chains through 'POP gadgets' present in WordPress core, other plugins/themes, or libraries bundled with the site to escalate from object instantiation to file write, SQL execution, or arbitrary code execution.

RemediationAI

Upgrade Eldon to a version greater than 1.4.1 once Edge-Themes publishes a fixed release; the Patchstack advisory at https://patchstack.com/database/wordpress/theme/eldon/vulnerability/wordpress-eldon-theme-1-4-1-php-object-injection-vulnerability should be monitored for the exact patched version, as no vendor-released patch version is independently confirmed in the supplied data. As compensating controls until a fix is applied, restrict access to the vulnerable theme endpoint(s) at the web server or WAF layer (Patchstack's vPatch / a WAF rule blocking serialized PHP payloads such as 'O:' and 'a:' patterns in user input is a targeted mitigation; trade-off is potential false positives on legitimate serialized data), audit installed plugins and remove unused ones to shrink the available POP gadget surface (trade-off: feature loss), and consider switching to a different theme if Eldon is non-essential since a vulnerable theme cannot be selectively deactivated while in use.