What is the CVSS score of CVE-2026-40753?

CVE-2026-40753 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of EasyMeals WordPress Theme are affected by CVE-2026-40753?

The Mikado-Themes EasyMeals WordPress theme (versions 1.5.1 and earlier) contains a critical unauthenticated PHP object injection vulnerability that enables remote code execution and complete site…

How to fix or mitigate CVE-2026-40753?

Within 24 hours: Audit all WordPress installations to identify systems running EasyMeals theme v1.5.1 or earlier. Within 7 days: Deactivate the vulnerable theme and deploy WAF rules to block PHP serialization-based object injection payloads. Within 30 days: Remove the theme completely and migrate to an alternative; monitor Mikado-Themes security advisories for patch availability.

EasyMeals WordPress Theme CVE-2026-40753

EUVD-2026-37602 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization Easymeals

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated deserialization (AV:N/PR:N/UI:N); AC:H because exploitation requires a viable POP gadget chain in the target stack; full C/I/A impact typical of PHP object injection.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 12:14 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in EasyMeals <= 1.5.1 versions.

AnalysisAI

Unauthenticated PHP Object Injection affects the Mikado-Themes EasyMeals WordPress theme through version 1.5.1, allowing remote attackers to inject crafted serialized objects that are deserialized by vulnerable PHP code paths. Successful exploitation can lead to high-impact compromise of confidentiality, integrity, and availability on the underlying WordPress site, though no public exploit identified at time of analysis. The CVSS 8.1 score reflects high attack complexity, consistent with the typical need for a usable gadget chain in the host WordPress environment.

Technical ContextAI

The vulnerability is a CWE-502 (Deserialization of Untrusted Data) flaw in the EasyMeals theme by Mikado-Themes, identified by CPE cpe:2.3:a:mikado-themes:easymeals through version 1.5.1. PHP Object Injection arises when user-controlled input reaches functions like unserialize() without validation, causing PHP to instantiate arbitrary classes and trigger magic methods such as __wakeup, __destruct, or __toString. In WordPress theme contexts these primitives are commonly chained with POP (Property-Oriented Programming) gadgets present in WordPress core, popular plugins, or PHP libraries, enabling outcomes like arbitrary file write, SQL injection, or remote code execution depending on which gadgets are loadable in the target environment.

RemediationAI

No vendor-released patch identified at time of analysis in the provided data; site operators running EasyMeals 1.5.1 or earlier should consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/easymeals/vulnerability/wordpress-easymeals-theme-1-5-1-php-object-injection-vulnerability and upgrade to a fixed release once published by Mikado-Themes. As compensating controls while a fix is awaited, deactivate and replace the EasyMeals theme with an unaffected theme (this will remove the front-end design and any theme-specific shortcodes), or place a WAF rule in front of WordPress that blocks request parameters containing serialized PHP patterns such as 'O:' or 'a:' followed by length-prefixed class names (note this may break legitimate plugins that pass serialized data). Where the vulnerable entry point can be identified from the advisory, restrict access to that endpoint via web server ACLs or .htaccess rules, accepting that this may disable affected theme functionality.