What is the CVSS score of CVE-2026-49107?

CVE-2026-49107 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Thrive Apprentice are affected by CVE-2026-49107?

Thrive Apprentice WordPress plugin (versions prior to 10.8.10.2) contains a critical unauthenticated remote code execution vulnerability (CVSS 9.8) enabling attackers to inject and execute arbitrary…. A patch is available.

How to fix or mitigate CVE-2026-49107?

Within 24 hours: Identify all WordPress sites using Thrive Apprentice plugin and document their current versions. Within 7 days: Upgrade all affected installations to version 10.8.10.2 or later; alternatively, deactivate and remove the plugin if not essential to business operations. Within 30 days: Conduct security audit of affected systems for evidence of unauthorized access or code injection.

Thrive Apprentice CVE-2026-49107

EUVD-2026-37622 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization Thrive Apprentice

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable PHP object injection with no user interaction; deserialization sinks in WordPress plugins typically yield full RCE, justifying C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 17, 2026 - 13:01 EUVD

Analysis Generated

Jun 17, 2026 - 12:03 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Thrive Apprentice < 10.8.10.2 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the Thrive Apprentice WordPress plugin (versions prior to 10.8.10.2) allows remote attackers to inject arbitrary PHP objects that get deserialized by the application, potentially leading to remote code execution when a suitable POP gadget chain is present. The flaw is reachable without authentication and carries a CVSS 9.8 critical rating with full confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Technical ContextAI

Thrive Apprentice is a commercial WordPress plugin from Thrive Themes used to build and sell online courses on WordPress sites. The CWE-502 classification (Deserialization of Untrusted Data) indicates that the plugin passes attacker-controlled input into PHP's unserialize() (or equivalent) without sufficient validation. In WordPress ecosystems, such sinks become exploitable for RCE when combined with magic methods (__wakeup, __destruct, __toString) on classes loaded by WordPress core, popular plugins, or the plugin itself - a pattern commonly referred to as a POP (Property Oriented Programming) chain. The CPE cpe:2.3:a:thrive_themes:thrive_apprentice:*:*:*:*:*:*:*:* confirms all versions of the plugin up to the fixed release are within scope.

RemediationAI

Upstream fix available; the Patchstack advisory designates 10.8.10.2 as the fixed release, so administrators should upgrade Thrive Apprentice to version 10.8.10.2 or later via the WordPress plugin updater or the Thrive Themes dashboard, and verify the installed version after update. Until patching is possible, restrict access to the WordPress site (especially any plugin endpoints handling serialized input) using a WAF with PHP object injection rules - for example Patchstack, Wordfence, or ModSecurity OWASP CRS rule 944150 - accepting that WAF rules can be bypassed and may cause false positives on legitimate serialized payloads. As a stronger compensating control, place the site behind authentication (HTTP basic auth or IP allowlisting on the front-end) until upgrade, with the trade-off that this breaks public course access. Full advisory: https://patchstack.com/database/wordpress/plugin/thrive-apprentice/vulnerability/wordpress-thrive-apprentice-plugin-10-8-10-2-php-object-injection-vulnerability?_s_id=cve.