What is the CVSS score of CVE-2026-40752?

CVE-2026-40752 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Manufaktur Solutions are affected by CVE-2026-40752?

The Manufaktur Solutions WordPress theme (versions 1.1.1 and earlier) contains an unauthenticated PHP object injection vulnerability (CVSS 8.1) that could allow attackers to execute arbitrary code on…

How to fix or mitigate CVE-2026-40752?

Within 24 hours: Audit all WordPress installations to identify deployments using Manufaktur Solutions theme and document business criticality of each. Within 7 days: Either migrate affected sites to an alternative WordPress theme or implement Web Application Firewall rules blocking PHP object injection patterns, plus enable detailed PHP execution logging and request inspection. Within 30 days: Complete migration away from Manufaktur Solutions theme; monitor for official patch release to version 1.1.2 or later from vendor; scan web logs and WordPress logs for historical exploitation indicators.

Manufaktur Solutions CVE-2026-40752

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization Manufaktur Solutions

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable WordPress theme endpoint with no auth (AV:N/PR:N/UI:N); AC:H because impact depends on a usable gadget chain; full C/I/A:H if chain achieves RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:31 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Manufaktur Solutions <= 1.1.1 versions.

AnalysisAI

Unauthenticated PHP object injection in the Manufaktur Solutions WordPress theme (versions 1.1.1 and earlier) allows remote attackers to deserialize attacker-controlled data, potentially leading to arbitrary code execution, data tampering, or denial of service when a suitable PHP gadget chain is present. The CVSS 3.1 score of 8.1 reflects high impact across confidentiality, integrity, and availability, tempered by AC:H due to dependency on exploitable gadget chains in the WordPress runtime. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) affecting the Manufaktur Solutions commercial WordPress theme developed by Select Themes (CPE: cpe:2.3:a:select-themes:manufaktur_solutions). PHP object injection occurs when user-controllable input is passed to unserialize() or equivalent routines without validation, allowing attackers to instantiate arbitrary PHP objects. Exploitation typically requires a 'gadget chain' - magic methods such as __wakeup, __destruct, or __toString - in the theme, WordPress core, or installed plugins that can be chained together to achieve file write, RCE, or SQL injection. WordPress themes often expose AJAX endpoints, form handlers, or option processors that pass serialized data unsafely, which is the likely sink in this theme.

RemediationAI

Patch status is ambiguous from the input data - the description bounds the issue at versions 1.1.1 and earlier, implying a fixed release exists, but no exact patched version number is independently confirmed in the provided references, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/manufaktursolutions/vulnerability/wordpress-manufaktur-solutions-theme-1-1-1-php-object-injection-vulnerability) and the Select Themes vendor channels for the exact fixed version and upgrade to it immediately. If an upgrade cannot be deployed promptly, compensating controls include deploying a WordPress WAF such as Patchstack, Wordfence, or a managed rule set to block serialized PHP objects (payloads containing patterns like 'O:' or 'a:' followed by class names) in HTTP parameters reaching theme endpoints, with the trade-off of potential false positives on legitimate serialized content. Restrict access to known theme AJAX and admin-ajax endpoints via IP allowlisting where feasible, audit installed plugins to reduce the gadget chain attack surface, and disable the theme entirely on staging or non-production instances until the patch is verified.