What is the CVSS score of CVE-2026-65574?

CVE-2026-65574 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Abogado are affected by CVE-2026-65574?

The Abogado WordPress theme (versions 1.18 and earlier) contains a critical unauthenticated PHP object injection vulnerability (CVE-2026-65574, CVSS 9.8) that could permit remote code execution…

How to fix or mitigate CVE-2026-65574?

Within 24 hours, inventory all WordPress installations to identify those running Abogado theme version 1.18 or earlier; deactivate the theme immediately on any affected sites to block exploitation. Within 7 days, check AncoraThemes for a patched version beyond 1.18 or prepare to replace Abogado with an alternative theme; test the upgrade or replacement in a staging environment. Within 30 days, complete rollout of either the patched Abogado version or a fully alternative theme across all production WordPress installations, then conduct a full security audit of affected systems to confirm no prior compromise.

Abogado CVE-2026-65574

EUVD-2026-53992 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-06 Patchstack

GHSA-w8mx-r4v3-qrr3

PHP WordPress Deserialization Abogado Wordpress Theme Ancorathemes

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable deserialization with no user interaction gives AV:N/AC:L/PR:N/UI:N; a viable POP chain yields full C:H/I:H/A:H, though realistic impact is gadget-dependent.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:48 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in Abogado <= 1.18 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the Abogado WordPress theme (by AncoraThemes) affects all versions up to and including 1.18, allowing remote attackers to inject crafted serialized PHP objects without authentication. If a suitable POP (property-oriented programming) gadget chain is present in the theme, its bundled plugins, or WordPress core, this can escalate to arbitrary file operations, SQL injection, or remote code execution. Reported by Patchstack; no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.

Technical ContextAI

The root cause is CWE-502 (Deserialization of Untrusted Data): the theme passes attacker-controlled input into PHP's unserialize() (or an equivalent object-instantiating routine) without validation. When PHP deserializes a string, it reconstructs objects and automatically invokes magic methods such as __wakeup() and __destruct(); an attacker who controls the serialized payload can therefore instantiate arbitrary in-scope classes and drive their magic methods. In the WordPress ecosystem this is exploited by chaining 'gadget' classes loaded by the theme, active plugins, or WordPress core into a POP chain, turning object injection into file writes/reads, deletion, SQLi, or code execution. The affected component is identified by CPE cpe:2.3:a:ancorathemes:abogado:*, a commercial lawyer/attorney WordPress theme; tags confirm Deserialization/PHP.

RemediationAI

No vendor-released patch identified at time of analysis - the input specifies only affected versions (≤1.18) and no fixed release. Monitor the Patchstack advisory (https://patchstack.com/database/wordpress/theme/abogado/vulnerability/wordpress-abogado-theme-1-18-php-object-injection-vulnerability) and the AncoraThemes vendor channel for an update, and upgrade to a patched version as soon as one is published. As compensating controls until then: deploy a WordPress WAF / virtual patch (Patchstack or equivalent) with rules for PHP object injection to filter serialized payloads at the edge; place the theme's vulnerable endpoint behind authentication or IP allow-listing and restrict/monitor the specific request parameter carrying the input (trade-off: may break legitimate front-end functionality that relies on that endpoint); and minimize installed plugins to shrink the pool of available POP gadget chains, which reduces exploitability without disabling the theme (trade-off: does not remove the injection point itself). If the site does not require the affected feature, consider switching to an alternative theme.