What is the CVSS score of CVE-2026-56055?

CVE-2026-56055 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of PHP are affected by CVE-2026-56055?

The RealHomes WordPress theme (versions 4.5.3 and earlier) exposes a critical vulnerability that converts compromised subscriber accounts into remote code execution pathways, threatening…

How to fix or mitigate CVE-2026-56055?

Within 24 hours: Audit all subscriber accounts; immediately disable user registration on affected instances and disable non-essential subscriber accounts. Within 7 days: Monitor RealHomes vendor and Patchstack advisory channels for patch release; deploy WAF policies targeting CWE-502 deserialization attacks; implement strict role-based access controls limiting subscriber capabilities. Within 30 days: Apply vendor patch to all affected RealHomes installations upon release; review access logs for exploitation attempts; conduct security assessment of subscriber account activity.

PHP CVE-2026-56055

EUVD-2026-39710 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-26 audit@patchstack.com

GHSA-gg9m-2j95-f3p4

PHP WordPress Deserialization Wordpress Theme

8.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (patchstack) · only source for this CVE.

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 26, 2026 - 16:01 vuln.today

DescriptionCVE.org

Subscriber PHP Object Injection in RealHomes <= 4.5.3 versions.

Articles & Coverage 1

News 8 New PHP Vulnerabilities - 2 Critical, 6 High, 1 With POC Jun 27, 2026

AnalysisAI

Authenticated PHP object injection in the RealHomes WordPress theme (versions 4.5.3 and earlier) lets a low-privileged Subscriber-level account inject crafted serialized objects into an unsafe deserialization sink (CWE-502). Because WordPress applications and plugins commonly contain POP gadget chains, this can escalate to arbitrary file operations, SQL injection, or remote code execution, which is reflected in the high CVSS 8.8 (C:H/I:H/A:H). Reported by Patchstack; no public exploit identified at time of analysis and it is not listed in CISA KEV.