What is the CVSS score of CVE-2026-40756?

CVE-2026-40756 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Zoya WordPress Theme are affected by CVE-2026-40756?

Mikado-Themes Zoya WordPress theme versions 1.4 and earlier contain an unauthenticated PHP Object Injection vulnerability (CVSS 8.1) enabling remote code execution without authentication.

How to fix or mitigate CVE-2026-40756?

24 hours: Identify all WordPress installations using Zoya theme v1.4 or earlier; document version inventory and site criticality. 7 days: Immediately disable or uninstall the vulnerable Zoya theme; alternatively, activate Web Application Firewall rules to block PHP object deserialization payloads; monitor vendor Mikado-Themes for security patches. 30 days: Establish automated plugin/theme version monitoring; implement WordPress security update policy requiring patch evaluation within 7 days of release.

Zoya WordPress Theme CVE-2026-40756

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization Zoya

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable WordPress theme endpoint with no auth or user interaction; AC:H because practical RCE requires a usable POP gadget chain; full CIA impact via deserialization-to-RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:30 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Zoya <= 1.4 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the Mikado-Themes Zoya WordPress theme versions 1.4 and earlier allows remote attackers to inject crafted serialized objects that are deserialized by the application. Successful exploitation can lead to arbitrary code execution, data tampering, or denial of service depending on the gadget chains present in WordPress core, plugins, or other themes loaded on the site. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

Zoya is a commercial WordPress theme distributed by Mikado-Themes (CPE cpe:2.3:a:mikado-themes:zoya). The flaw is rooted in CWE-502 (Deserialization of Untrusted Data): attacker-controlled input reaches a PHP unserialize() call (or equivalent) without prior validation, instantiating arbitrary PHP objects. In WordPress environments, PHP Object Injection is typically weaponised through 'POP gadget chains' present in bundled libraries (e.g., Guzzle, Monolog, PHPMailer) or in WordPress itself, allowing attackers to leverage __wakeup/__destruct magic methods to achieve file writes, SSRF, or command execution. Patchstack, who reported the issue, classifies this as a theme-level vulnerability rather than a plugin/core flaw.

RemediationAI

No vendor-released patch identified at time of analysis; the Patchstack advisory (https://patchstack.com/database/wordpress/theme/zoya/vulnerability/wordpress-zoya-theme-1-4-php-object-injection-vulnerability) should be monitored for an updated Zoya release above 1.4 and the theme upgraded as soon as one is published. As compensating controls, administrators should deploy a WordPress WAF (Patchstack, Wordfence) with virtual patching for CVE-2026-40756 to block serialized payloads (strings beginning with O:, a:, s:) on theme endpoints, restrict access to the affected theme's AJAX and front-controller handlers via web server rules, and audit installed plugins to remove known POP-gadget sources where feasible - noting that aggressive serialized-payload filtering can break legitimate cookies or form fields and should be tuned. If business needs allow, temporarily switching to a different theme eliminates exposure until a fixed Zoya version ships.