What is the CVSS score of CVE-2026-65573?

CVE-2026-65573 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Abelle are affected by CVE-2026-65573?

Abelle WordPress theme (ThemeREX) versions 1.22 and earlier contains a critical remote code execution vulnerability allowing unauthenticated attackers to achieve arbitrary PHP execution through…

How to fix or mitigate CVE-2026-65573?

Within 24 hours, identify all WordPress instances running Abelle theme v1.22 or earlier and immediately deactivate the theme on affected sites. Within 7 days, migrate to an alternative WordPress theme and implement WAF rules blocking serialized PHP object patterns; additionally, restrict administrative access to WordPress via IP allowlisting and monitor access logs for exploitation attempts. Within 30 days, complete full site migrations away from Abelle, conduct malware scans on previously affected systems, and establish an automated WordPress theme/plugin inventory system to detect future critical vulnerabilities.

Abelle CVE-2026-65573

EUVD-2026-53991 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-06 Patchstack

GHSA-3wp2-2c4h-hf64

PHP WordPress Deserialization Abelle Wordpress Theme Themerex

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable deserialization (AV:N/AC:L/PR:N/UI:N) with potential for full code execution justifies high C/I/A; scope unchanged as it executes within the app context.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:48 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.

AnalysisAI

Insecure deserialization in the Abelle WordPress theme (ThemeREX) versions 1.22 and earlier lets unauthenticated remote attackers inject crafted PHP objects that the application deserializes, enabling PHP Object Injection. Because attacker-supplied serialized data reaches unsafe unserialize() logic without authentication, an adversary can potentially achieve remote code execution, data tampering, or full site compromise depending on available gadget chains in WordPress core, the theme, or co-installed plugins. There is no public exploit identified at time of analysis, but the flaw carries a CVSS 9.8 rating reflecting network-reachable, unauthenticated, high-impact exploitation.

Technical ContextAI

The vulnerability is a CWE-502 Deserialization of Untrusted Data issue in a WordPress theme distributed by ThemeREX (CPE cpe:2.3:a:themerex:abelle). PHP Object Injection arises when user-controlled input is passed to PHP's unserialize() function; an attacker can craft a serialized object whose properties trigger 'magic methods' (__wakeup, __destruct, __toString) during or after deserialization. On their own these injected objects may do little, but combined with 'POP gadget chains' present in WordPress core or bundled plugins/libraries they can be leveraged into file writes, SQL injection, arbitrary file deletion, or code execution. As a theme-level flaw, exploitation depends on which theme feature accepts and deserializes the untrusted input, which the advisory does not detail.

RemediationAI

No vendor-released patch version is identified in the available data, and the EUVD record lists no fixed release. Consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/abelle/vulnerability/wordpress-abelle-theme-1-22-php-object-injection-vulnerability) and the ThemeREX vendor channel for an updated theme release above 1.22; upgrade to it as soon as one is confirmed. Until a fix is available, apply specific compensating controls: deploy a WordPress virtual-patching WAF (such as Patchstack) with a rule blocking serialized PHP object payloads (input containing patterns like 'O:' or 'a:' in request parameters), which may cause false positives on legitimate serialized data and should be tested; restrict access to theme endpoints that accept POST/GET input where feasible; and if the theme is non-essential, switch to a maintained theme to eliminate the exposure entirely, accepting the visual/layout change that entails.