What is the CVSS score of CVE-2026-42380?

CVE-2026-42380 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of AI Lab Theme are affected by CVE-2026-42380?

The AI Lab WordPress theme (versions prior to 5.4.2) contains a critical unauthenticated PHP object injection vulnerability (CVSS 9.8) enabling remote code execution and complete site takeover…. A patch is available.

How to fix or mitigate CVE-2026-42380?

Within 24 hours: Inventory all WordPress installations using AI Lab theme; identify systems running versions prior to 5.4.2; isolate critical instances; prepare rollback and recovery procedures. Within 7 days: Deploy Web Application Firewall rules to detect and block PHP serialization payloads; restrict PHP execution in upload directories; disable the vulnerable theme; enable detailed access logging; audit installed plugins for known POP gadget chain vulnerabilities. Within 30 days: No vendor-released patch identified at time of analysis-monitor vendor advisory channels for patch availability; plan and execute migration to alternative WordPress theme; conduct full WordPress security audit. Note: no public exploit identified at time of analysis, but critical severity warrants immediate defensive action.

AI Lab Theme CVE-2026-42380

EUVD-2026-37607 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization Ai Lab

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable deserialization in a WordPress theme typically yields RCE via POP chains, justifying AV:N/AC:L/PR:N/UI:N and full C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 17, 2026 - 13:01 EUVD

Analysis Generated

Jun 17, 2026 - 12:11 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in AI Lab < 5.4.2 versions.

Articles & Coverage 1

News Critical PHP Object Injection in AI Lab WordPress Theme - CVE-2026-42380 Jun 18, 2026

AnalysisAI

Unauthenticated PHP Object Injection in the AI Lab WordPress theme versions prior to 5.4.2 enables remote attackers to deliver crafted serialized payloads to a vulnerable deserialization sink. With a CVSS 9.8 rating and no authentication required, successful exploitation can lead to arbitrary code execution, data theft, or full site takeover depending on which POP gadget chains are available in WordPress core or installed plugins. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

The vulnerability is a CWE-502 Deserialization of Untrusted Data flaw in the AI Lab commercial WordPress theme by jwsthemes (CPE cpe:2.3:a:jwsthemes:ai_lab). PHP Object Injection occurs when user-controlled input reaches PHP's unserialize() function, allowing an attacker to instantiate arbitrary classes already loaded in the runtime. The real impact depends on Property-Oriented Programming (POP) gadget chains present in WordPress core, other active plugins, or the theme itself - magic methods such as __wakeup, __destruct, or __toString can be abused to trigger file writes, SQL queries, or command execution. As a theme-level flaw it is exposed on any WordPress site that has AI Lab installed and activated.

RemediationAI

Upgrade the AI Lab theme to version 5.4.2 or later, which is the vendor-released patch identified in the Patchstack advisory (https://patchstack.com/database/wordpress/theme/ailab/vulnerability/wordpress-ai-lab-theme-5-4-2-php-object-injection-vulnerability). If immediate patching is not possible, deactivate and switch away from the AI Lab theme - note this will break the site's frontend appearance and any theme-specific shortcodes. As a temporary compensating control, place the site behind a WAF (such as Patchstack, Wordfence, or Cloudflare managed rules) configured to block serialized PHP payloads (requests containing patterns like O:NN:" or a:N:{) on theme endpoints, accepting some risk of false positives on legitimate serialized cookies or form data. Audit installed plugins to reduce the universe of available POP gadget chains while you remediate.