What is the CVSS score of CVE-2026-40761?

CVE-2026-40761 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Valeska are affected by CVE-2026-40761?

The Edge-Themes Valeska WordPress theme versions 1.2.2 and earlier contain an unauthenticated remote code execution vulnerability enabling attackers to compromise affected WordPress installations…

How to fix or mitigate CVE-2026-40761?

Within 24 hours: Inventory all WordPress instances and identify those running Valeska theme version 1.2.2 or earlier; flag for immediate action. Within 7 days: Remove the Valeska theme and deploy a security-reviewed alternative WordPress theme; audit WordPress logs, server access logs, and file integrity for evidence of compromise. Within 30 days: Complete decommissioning of all Valeska theme instances; update WordPress core to latest stable version; deploy WordPress hardening plugins (Wordfence, Sucuri); enable WAF rules blocking PHP object serialization patterns.

Valeska CVE-2026-40761

EUVD-2026-37493 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization Valeska

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable WordPress theme sink with no auth or user interaction; AC:H because exploitation requires a working gadget chain; full CIA impact via object-injection-to-RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:28 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Valeska <= 1.2.2 versions.

AnalysisAI

Unauthenticated PHP object injection in Edge-Themes Valeska WordPress theme versions 1.2.2 and earlier allows remote attackers to trigger insecure deserialization, potentially leading to code execution, file manipulation, or full site compromise when suitable PHP magic-method gadgets are present in the WordPress stack. No public exploit identified at time of analysis, but Patchstack has catalogued the flaw and the high CVSS (8.1) reflects the serious confidentiality, integrity, and availability impact possible against affected installations.

Technical ContextAI

The vulnerability is a CWE-502 (Deserialization of Untrusted Data) issue in Valeska, a commercial WordPress theme published by Edge-Themes (CPE cpe:2.3:a:edge-themes:valeska). PHP object injection occurs when attacker-controlled data reaches a call to unserialize(), allowing the attacker to instantiate arbitrary PHP objects. Once an object is reconstructed, PHP magic methods such as __wakeup(), __destruct(), or __toString() execute automatically; combined with gadget chains commonly present in WordPress core, plugins, or other themes, this can be escalated to arbitrary file write/read, SQL injection, or remote code execution. The root cause is typically deserialization of user input from a request parameter, cookie, or AJAX handler without prior validation or replacement with safe formats such as JSON.

RemediationAI

No vendor-released patch identified at time of analysis in the supplied data; site operators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/valeska/vulnerability/wordpress-valeska-theme-1-2-2-php-object-injection-vulnerability for the latest fixed version from Edge-Themes and upgrade Valeska beyond 1.2.2 once published. Until a patched release is confirmed, deactivate and remove the Valeska theme (switching to an interim theme will break the site's visual layout and any theme-specific shortcodes), or place a WAF rule in front of the site to block serialized PHP payloads (strings beginning with patterns like O:NN:" or a:NN:{) on parameters handled by the theme - this can produce false positives for legitimate serialized data and should be tested in detection mode first. Additionally, audit installed plugins and themes to reduce the gadget-chain surface that makes object injection exploitable, and rotate WordPress secrets and admin credentials if compromise cannot be ruled out.