What is the CVSS score of CVE-2026-40760?

CVE-2026-40760 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Behold WordPress Theme are affected by CVE-2026-40760?

The Behold WordPress theme (versions 1.5 and earlier) contains a critical vulnerability enabling unauthenticated attackers to completely compromise affected WordPress sites.

How to fix or mitigate CVE-2026-40760?

Within 24 hours: inventory all WordPress installations and identify active deployments of Behold theme ≤v1.5; assess business criticality and prioritize remediation for customer-facing systems. Within 7 days: disable or uninstall the vulnerable theme and migrate to an actively maintained alternative WordPress theme; apply all pending WordPress core security updates. Within 30 days: validate replacement theme functionality in production; conduct forensic review of affected systems for indicators of exploitation.

Behold WordPress Theme CVE-2026-40760

EUVD-2026-37492 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization Behold

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network-reachable deserialization (AV:N/PR:N/UI:N); AC:H because exploitation depends on a usable gadget chain in the runtime; full CIA impact via arbitrary code execution.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:29 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Behold <= 1.5 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the Behold WordPress theme (versions ≤1.5) by edge-themes allows remote attackers to deliver crafted serialized payloads that are deserialized by the theme without validation. Successful exploitation can lead to full compromise of the affected WordPress site through gadget-chain abuse, with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

The vulnerability falls under CWE-502 (Deserialization of Untrusted Data), a classic PHP Object Injection (POI) flaw. PHP's unserialize() rebuilds objects from attacker-controlled strings and triggers magic methods (__wakeup, __destruct, __toString) on the resulting instances. When called on user input without an allowed-classes restriction, an attacker can pivot through any 'gadget' class loaded in the WordPress runtime - including those from WordPress core, other active plugins, or Composer dependencies - to chain primitives leading to file write, file deletion, SQL injection, or arbitrary code execution. The affected component is identified by CPE cpe:2.3:a:edge-themes:behold:*:*:*:*:*:*:*:*, indicating all distributed versions of the Behold theme by edge-themes up to and including 1.5 are in scope.

RemediationAI

No vendor-released patch identified at time of analysis from the provided data - the Patchstack advisory at https://patchstack.com/database/wordpress/theme/behold/vulnerability/wordpress-behold-theme-1-5-php-object-injection-vulnerability should be checked for an updated fixed version beyond 1.5. Until a patched release is confirmed, administrators should consider deactivating and removing the Behold theme or switching to an alternative theme, which fully eliminates the attack surface but obviously changes site appearance. As a compensating control, a WAF rule (such as Patchstack's vPatch service) can block requests containing serialized PHP object markers (e.g., 'O:' or 'a:' patterns in suspicious parameters) targeting the theme's endpoints; this may produce false positives on legitimate serialized data and must be tuned. Restricting access to theme endpoints via IP allow-listing or basic auth at the web server level is another option but only practical for non-public sites.