What is the CVSS score of CVE-2026-40759?

CVE-2026-40759 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Esmée Theme are affected by CVE-2026-40759?

The Mikado Themes 'Esmée' WordPress theme (versions through 1.4) contains an unauthenticated object injection vulnerability that allows remote attackers to execute arbitrary code on affected…

How to fix or mitigate CVE-2026-40759?

Within 24 hours: Identify all WordPress installations running 'Esmée' theme versions 1.4 and earlier; restrict public access to affected sites if operationally feasible. Within 7 days: Subscribe to Mikado Themes security advisories and prepare staging environment for patch validation once released. Within 30 days: Apply vendor patch upon release or migrate to alternative WordPress theme; audit system logs for exploitation indicators including suspicious file modifications, database queries, and web shell uploads.

Esmée Theme CVE-2026-40759

EUVD-2026-37491 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization Esm E

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated deserialization with no user interaction; AC:H reflects required PHP gadget chain; full CIA impact via RCE on the WordPress host.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:29 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.

AnalysisAI

Unauthenticated PHP object injection in the Mikado Themes 'Esmée' WordPress theme (versions through 1.4) allows remote attackers to inject crafted serialized objects that are processed by unsafe deserialization. Exploitation depends on the presence of usable PHP gadget chains (often from WordPress core or co-installed plugins/themes), and no public exploit identified at time of analysis, but successful attacks can lead to file write, SQL manipulation, or remote code execution on the underlying site. The CVSS 3.1 base score is 8.1 with high attack complexity, reflecting the gadget-chain dependency rather than the network-reachable, unauthenticated entry point itself.

Technical ContextAI

The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data) within the Esmée commercial WordPress theme by Mikado-Themes (CPE cpe:2.3:a:mikado-themes:esmée:*). PHP's unserialize() function reconstructs object instances and invokes magic methods such as __wakeup, __destruct, and __toString during instantiation; when attacker-controlled input is fed into unserialize(), an attacker can craft a serialized payload that triggers a 'POP chain' (Property-Oriented Programming) through gadget classes available in the running PHP process. In a WordPress context the typical exploitation primitives come from WordPress core (e.g., Requests/Guzzle), bundled libraries, or other installed plugins, which together enable arbitrary file operations, SQL execution, or code execution. The Patchstack-reported tags (Deserialization, PHP) and the single Patchstack reference align with this class of WordPress theme PHP object injection.

RemediationAI

No vendor-released patch identified at time of analysis: the advisory only specifies affected versions ≤ 1.4 with no fixed version listed in the provided data. Site operators should monitor the Mikado-Themes vendor channel and the Patchstack advisory (https://patchstack.com/database/wordpress/theme/esme/vulnerability/wordpress-esmee-theme-1-4-php-object-injection-vulnerability) for a fixed release and upgrade as soon as one is published. Until a patch is available, deactivate and remove the Esmée theme if feasible (trade-off: site appearance must be replaced with another theme), or place the site behind a WAF (e.g., Patchstack, Wordfence) with rules that block serialized PHP payloads - strings beginning with 'O:', 'a:', or 's:' - in request parameters, cookies, and POST bodies targeting theme endpoints (trade-off: potential false positives on legitimate serialized data). Additionally, restrict access to theme-related PHP endpoints via web server ACLs and disable any non-essential theme features that accept user-supplied parameters; rotate WordPress secrets and audit for webshells if exposure period is uncertain.