What is the CVSS score of CVE-2026-49108?

CVE-2026-49108 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Moderno WordPress Theme are affected by CVE-2026-49108?

The Moderno WordPress theme (versions prior to 1.43) contains a critical unauthenticated remote code execution vulnerability via PHP object injection that allows attackers to execute arbitrary code…

How to fix or mitigate CVE-2026-49108?

Within 24 hours: Audit WordPress instances for Moderno theme installations and document version numbers; assess whether exploitation is feasible by identifying available POP gadget chains in installed WordPress plugins and core. Within 7 days: Disable or remove the Moderno theme from all production installations; deploy WAF rules blocking serialized object payloads if theme removal is not immediately feasible. Within 30 days: Establish a vendor communication cadence to track patch release for version 1.43; evaluate theme replacement options or commit to alternative WordPress security hardening controls.

Moderno WordPress Theme CVE-2026-49108

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization Moderno

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network sink (PR:N/AV:N) but practical RCE requires a viable POP gadget chain in co-installed code, justifying AC:H; full CIA impact retained.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:29 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Moderno < 1.43 versions.

AnalysisAI

Remote code execution via unauthenticated PHP Object Injection affects the Moderno WordPress theme in all versions prior to 1.43, enabling attackers to send crafted serialized payloads that trigger malicious object instantiation. With CVSS 9.8 and a fully remote, no-interaction attack vector, successful exploitation hinges on the presence of usable POP gadget chains in WordPress core or co-installed plugins. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Technical ContextAI

The flaw is a CWE-502 Deserialization of Untrusted Data issue in the Moderno theme by park_of_ideas, distributed for the WordPress CMS. PHP Object Injection occurs when user-controllable input is passed to PHP's unserialize() function, allowing attackers to instantiate arbitrary classes whose magic methods (__wakeup, __destruct, __toString) execute during deserialization. In the WordPress ecosystem, such injection points are typically chained with property-oriented programming (POP) gadgets present in WordPress core, popular plugins, or bundled libraries (e.g., Requests, Guzzle, Monolog) to escalate from object instantiation to arbitrary file write, SQL injection, or remote code execution. The affected CPE cpe:2.3:a:park_of_ideas:moderno:*:*:*:*:*:*:*:* indicates all versions of the theme up to the patched release are in scope.

RemediationAI

Patch available per vendor advisory: upgrade the Moderno theme to version 1.43 or later, as documented at https://patchstack.com/database/wordpress/theme/moderno/vulnerability/wordpress-moderno-theme-1-43-php-object-injection-vulnerability. If immediate upgrade is not feasible, restrict access to the vulnerable endpoint(s) using a WAF rule that blocks requests containing PHP-serialized payload markers (e.g., parameters beginning with 'O:', 'a:', or 's:') against the theme's handlers - accepting that legitimate serialized cookies or form data may also be blocked. Audit co-installed plugins for known POP gadget chains and remove or update vulnerable components to reduce exploit feasibility, and consider temporarily deactivating the Moderno theme in favor of a safe default theme until patching is complete.