What is the CVSS score of CVE-2026-40758?

CVE-2026-40758 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Léonie WordPress Theme are affected by CVE-2026-40758?

The Léonie WordPress theme by Elated Themes (versions 1.2.1 and earlier) contains an unauthenticated PHP object injection vulnerability enabling attackers to execute arbitrary code and achieve…

How to fix or mitigate CVE-2026-40758?

24 hours: Audit all WordPress installations to identify instances of Léonie theme version 1.2.1 or earlier and assess available POP gadget chains in installed plugins. 7 days: Deactivate and uninstall the Léonie theme across all affected sites; migrate to an alternative WordPress theme with current security patches. 30 days: Deploy Web Application Firewall rules to detect PHP deserialization attack patterns on any remaining legacy applications; implement mandatory WordPress security hardening standards for all future theme selection.

Léonie WordPress Theme CVE-2026-40758

EUVD-2026-37490 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization L Onie

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated deserialization (AV:N/PR:N/UI:N); AC:H reflects dependency on a viable POP gadget chain in the host WordPress stack; full CIA impact via RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:30 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Léonie <= 1.2.1 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the Léonie WordPress theme (versions ≤ 1.2.1) by Elated Themes allows remote attackers to deserialize attacker-controlled data, potentially leading to arbitrary code execution, file manipulation, or full site compromise when a suitable POP gadget chain exists in the WordPress stack. Reported by Patchstack and tracked as EUVD-2026-37490, with no public exploit identified at time of analysis but a high CVSS score of 8.1 reflecting the severity of unauthenticated deserialization. No KEV listing is present.

Technical ContextAI

The vulnerability is a CWE-502 (Deserialization of Untrusted Data) flaw in the Léonie commercial WordPress theme distributed by Elated Themes (CPE cpe:2.3:a:elated-themes:léonie). PHP Object Injection occurs when user-controllable input is passed to PHP's unserialize() function, allowing attackers to instantiate arbitrary classes and trigger magic methods such as __wakeup(), __destruct(), or __toString(). In the WordPress ecosystem, even when the vulnerable theme lacks a directly exploitable gadget, attackers commonly chain the injection with POP gadgets present in WordPress core, popular plugins (e.g., Contact Form 7, WooCommerce), or bundled libraries to achieve file write, SQL execution, or RCE. The 'L Onie' tag and EUVD entry indicate this is a niche theme but exposed wherever it is installed.

RemediationAI

No vendor-released patch version is identified in the provided data; defenders should consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/lonie/vulnerability/wordpress-leonie-theme-1-2-1-php-object-injection-vulnerability for the fixed release once published by Elated Themes, and upgrade to any version above 1.2.1. As compensating controls until a confirmed patched version is available, administrators should deploy a WAF rule (Patchstack, Wordfence, or equivalent) to block serialized PHP payloads (patterns matching O:, a:, or s: in request parameters reaching theme endpoints), disable or replace the Léonie theme on production sites - accepting the trade-off of frontend appearance changes - and audit installed plugins to reduce the universe of available POP gadget chains. Restrict access to the WordPress site to known IPs where feasible.