What is the CVSS score of CVE-2026-40757?

CVE-2026-40757 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Château Theme are affected by CVE-2026-40757?

The Château WordPress theme (version 1.2.1 and earlier) contains a critical vulnerability allowing unauthenticated attackers to remotely execute code on affected websites.

How to fix or mitigate CVE-2026-40757?

Within 24 hours: Audit all WordPress installations to identify Château theme version 1.2.1 or earlier; immediately disable or remove the affected theme and switch to an alternative. Within 7 days: Verify complete removal of the vulnerable theme from all systems, review access logs for exploitation indicators, and assess whether unauthorized access or modification occurred. Within 30 days: Monitor Patchstack and Mikado-Themes for patched versions; deploy only after independent security verification.

Château Theme CVE-2026-40757

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization Ch Teau

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable HTTP endpoint, no auth or UI, but AC:H because successful exploitation depends on a usable POP gadget chain; full CIA impact via potential RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:30 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Château <= 1.2.1 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the Mikado-Themes 'Château' WordPress theme (versions ≤ 1.2.1) allows remote attackers to deserialize attacker-controlled data, potentially leading to arbitrary code execution, file manipulation, or full site compromise when a suitable POP gadget chain is present in the WordPress stack. The flaw was disclosed via Patchstack with CVSS 8.1 (high) due to network-reachable, unauthenticated impact across confidentiality, integrity, and availability, though high attack complexity (AC:H) reflects the dependency on a usable gadget chain. No public exploit identified at time of analysis.

Technical ContextAI

The vulnerability is a CWE-502 'Deserialization of Untrusted Data' issue in a commercial Mikado-Themes WordPress theme (CPE: cpe:2.3:a:mikado-themes:château:*). PHP Object Injection occurs when user-controlled input reaches PHP's unserialize() function, allowing an attacker to instantiate arbitrary classes and trigger their magic methods (__wakeup, __destruct, __toString). On WordPress sites, gadget chains in core, common plugins (e.g., WooCommerce), or other themes frequently turn object injection into file write, SQLi, or RCE - meaning even a 'simple' deserialization sink in a theme can escalate to full takeover depending on the surrounding stack.

RemediationAI

Upgrade the Château theme to a version newer than 1.2.1 as soon as the vendor publishes a patched release; consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/chateau/vulnerability/wordpress-chateau-theme-1-2-1-php-object-injection-vulnerability) for the exact fixed version, as no specific fix version was provided in the input data and so no patch version can be cited with confidence. Until a patched release is installed, compensating controls include deploying a WordPress-aware WAF rule (Patchstack, Wordfence, or similar) that blocks serialized PHP payloads in request parameters, temporarily switching the active theme to a non-vulnerable alternative (side effect: visible site appearance change), and disabling or restricting access to the specific theme endpoint or AJAX handler that accepts the untrusted input once identified from the advisory. Operators should also audit installed plugins to reduce available POP gadget chains and ensure WordPress core and PHP are fully patched.