What is the CVSS score of CVE-2026-65572?

CVE-2026-65572 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of A.Williams Theme are affected by CVE-2026-65572?

The A.Williams WordPress theme (AxiomThemes, versions ≤1.3.1) contains a critical PHP object injection vulnerability allowing unauthenticated remote attackers to execute arbitrary code on affected…

How to fix or mitigate CVE-2026-65572?

Within 24 hours, identify all instances of the A.Williams theme deployed across your WordPress infrastructure and verify which versions are in use; simultaneously audit installed plugins for known POP gadget chains that could enable escalation to remote code execution. Within 7 days, implement Web Application Firewall rules to block malicious serialized object payloads, consider disabling or removing the theme if not business-critical, and enable PHP error logging to detect exploitation attempts. Within 30 days, establish continuous monitoring of AxiomThemes' advisory channels for a vendor patch, and prepare an emergency deployment plan to update immediately upon patch availability.

A.Williams Theme CVE-2026-65572

EUVD-2026-53990 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-06 Patchstack

GHSA-mq39-r4w7-92mj

PHP WordPress Deserialization A Williams Wordpress Theme Axiomthemes

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network vector (PR:N/UI:N), but realistic impact needs a usable POP gadget chain, raising attack complexity to AC:H; full impact retained when a chain exists.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:49 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in A.Williams <= 1.3.1 versions.

AnalysisAI

PHP Object Injection in the A.Williams (Alisha Williams) WordPress theme by AxiomThemes affects all versions up to and including 1.3.1, allowing remote unauthenticated attackers to inject crafted serialized PHP objects into an unsafe deserialization sink. When a suitable POP gadget chain is present in the theme or co-installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the 9.8 CVSS reflects theoretical worst-case impact rather than confirmed active exploitation.

Technical ContextAI

The root cause is CWE-502 (Deserialization of Untrusted Data): the theme passes attacker-controllable input to PHP's unserialize() (or an equivalent) without validation. In WordPress, PHP Object Injection becomes dangerous when a 'property-oriented programming' (POP) gadget chain - a set of classes with exploitable __wakeup(), __destruct(), or __toString() magic methods - is reachable at runtime, either in the theme itself, WordPress core, or any active plugin. The affected component is identified by CPE cpe:2.3:a:axiomthemes:a.williams:*:*:*:*:*:*:*:*, a commercial/premium WordPress theme distributed by AxiomThemes. Because deserialization runs inside the PHP process, successful exploitation inherits the web server's privileges and the WordPress database context.

RemediationAI

No fixed version is stated in the available data, so no vendor-released patch is identified at time of analysis - the vulnerability covers all releases through 1.3.1. Consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/alisha-williams/vulnerability/wordpress-a-williams-theme-1-3-1-php-object-injection-vulnerability) and the AxiomThemes vendor channel for an updated build above 1.3.1 and upgrade as soon as one is published. Until a patched version exists, apply compensating controls: deploy a WAF or the Patchstack virtual patch to block serialized-object payloads (strings containing patterns like O:<n>: or a:<n>: in requests) reaching the theme, which may cause false positives on legitimate serialized data; restrict or disable the specific theme endpoint/AJAX action that accepts the untrusted input if it can be identified; or switch to an alternative theme if the site can tolerate it. As a last resort, audit and remove reachable POP gadget chains from active plugins to reduce exploitability, accepting that this does not eliminate the underlying deserialization flaw.