What is the CVSS score of CVE-2026-40739?

CVE-2026-40739 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of LuxeDrive Theme are affected by CVE-2026-40739?

The Mikado-Themes LuxeDrive WordPress theme (versions 1.4 and below) contains an unauthenticated remote code execution vulnerability allowing attackers to compromise any affected WordPress site…

How to fix or mitigate CVE-2026-40739?

24 hours: Identify all WordPress instances using Mikado-Themes LuxeDrive version 1.4 and below; disable the theme on all non-production sites; establish log monitoring for suspicious POST requests and PHP serialization patterns to theme directories. 7 days: Deploy Web Application Firewall rules blocking serialized PHP payload delivery; contact Mikado-Themes support for patch timeline and severity confirmation; evaluate alternative WordPress themes with active security maintenance. 30 days: Deploy patched theme version (exact version TBD by Mikado-Themes) to all production sites; if patch is not released, complete migration to vendor-supported alternative theme.

LuxeDrive Theme CVE-2026-40739

EUVD-2026-37486 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization Luxedrive

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network deserialization (AV:N/PR:N/UI:N); AC:H because exploitation depends on a usable POP gadget chain; full C/I/A impact on the WordPress host.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:32 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.

AnalysisAI

Unauthenticated PHP object injection in the Mikado-Themes LuxeDrive WordPress theme through version 1.4 allows remote attackers to deliver crafted serialized payloads that, when combined with a suitable POP gadget chain, can lead to remote code execution, data tampering, or service disruption on the underlying WordPress site. No public exploit identified at time of analysis, and the CVSS attack complexity is High because successful exploitation typically depends on the presence of a usable gadget chain in WordPress core, other plugins, or themes installed alongside LuxeDrive. The flaw is tracked by Patchstack and EUVD as EUVD-2026-37486.

Technical ContextAI

The vulnerability is a CWE-502 Deserialization of Untrusted Data issue in LuxeDrive, a commercial WordPress theme distributed by Mikado-Themes (CPE cpe:2.3:a:mikado-themes:luxedrive). PHP object injection arises when user-controllable input is passed to PHP's unserialize() (or equivalent) without validation, allowing an attacker to instantiate arbitrary classes and trigger their magic methods such as __wakeup, __destruct, or __toString. In a WordPress context, the practical impact depends on POP (Property-Oriented Programming) gadget chains exposed by WordPress core or other installed plugins and themes, which can be combined to achieve file writes, SQL operations, or arbitrary code execution under the web server user.

RemediationAI

Upstream fix availability is not independently confirmed from the supplied data; the Patchstack entry should be consulted at https://patchstack.com/database/wordpress/theme/luxedrive/vulnerability/wordpress-luxedrive-theme-1-4-php-object-injection-vulnerability for the latest fixed-version guidance, and administrators should upgrade LuxeDrive to any vendor-released version above 1.4 once Mikado-Themes publishes a patched build. Until a confirmed patched release is installed, compensating controls include deactivating and removing the LuxeDrive theme in favor of an unaffected theme (which removes the vulnerability entirely but breaks site appearance and any theme-specific functionality), deploying a WAF rule (Patchstack mUNI/vPatch or equivalent) to block requests carrying serialized PHP payloads such as parameters beginning with 'O:' or 'a:' on theme endpoints (with a risk of false positives on legitimate serialized data), and auditing the site for and removing plugins known to provide usable POP gadget chains to reduce the chance that injection translates into code execution. Restricting access to the WordPress front-end and admin via IP allowlists or authentication proxies is a further mitigation where business requirements allow, at the cost of public accessibility.