What is the CVSS score of CVE-2026-65575?

CVE-2026-65575 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Accalia are affected by CVE-2026-65575?

The Accalia WordPress theme (all versions through 1.5.3) contains an unauthenticated remote code execution vulnerability enabling attackers to completely compromise affected WordPress sites without…

How to fix or mitigate CVE-2026-65575?

Within 24 hours: inventory all WordPress installations for Accalia theme presence and version; immediately deactivate the theme and deploy a replacement (use WordPress default themes or vetted alternatives as interim solution). Within 7 days: if immediate theme replacement is not operationally feasible, deploy Web Application Firewall rules blocking POST requests to vulnerable PHP endpoints and enable real-time log monitoring for serialized object patterns; coordinate with your hosting provider for network-layer protections. Within 30 days: complete permanent remediation by either migrating to a secure theme replacement or implementing vendor patch once released; perform security scanning and code review to confirm vulnerability closure.

Accalia CVE-2026-65575

EUVD-2026-53993 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-06 Patchstack

GHSA-hccw-55hg-mfxv

PHP WordPress Deserialization Accalia Wordpress Theme Ancorathemes

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable deserialization (AV:N/AC:L/PR:N/UI:N) with potential RCE gives high C/I/A; scope unchanged as impact stays within the WordPress application.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:48 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the Accalia WordPress theme (by AncoraThemes) affects all versions up to and including 1.5.3, allowing remote attackers to inject crafted serialized PHP objects that are deserialized by the application. When a suitable POP (property-oriented programming) gadget chain is present in the theme, its plugins, or WordPress core, this can lead to remote code execution, data disclosure, or site takeover. The issue was reported by Patchstack and carries a CVSS 9.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The vulnerability is a CWE-502 (Deserialization of Untrusted Data) flaw in a commercial WordPress theme. PHP Object Injection occurs when user-controllable input is passed to PHP's unserialize() without validation, letting an attacker instantiate arbitrary PHP objects and control their properties. Because magic methods such as __wakeup(), __destruct(), and __toString() fire automatically during and after deserialization, an attacker who can reach a gadget chain (in the theme, an active plugin, or WordPress core) can escalate the injection into file writes, SQL manipulation, or arbitrary code execution. The CPE cpe:2.3:a:ancorathemes:accalia:*:*:*:*:*:*:*:* confirms the affected component is the AncoraThemes 'Accalia' theme running on a PHP/WordPress stack; the 'Deserialization' and 'PHP' tags corroborate the object-injection root cause.

RemediationAI

No vendor-released patched version is identified in the available data, so the fixed release could not be independently confirmed; consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/accalia/vulnerability/wordpress-accalia-theme-1-5-3-php-object-injection-vulnerability) and the AncoraThemes vendor page for an update beyond 1.5.3 and apply it as the primary fix once available. As compensating controls, deploy a WordPress WAF or Patchstack's virtual patch to block malicious serialized payloads reaching theme endpoints; restrict or filter the specific request parameters that feed the vulnerable deserialization path; and audit installed plugins/core for known POP gadget chains to reduce exploitability, accepting that WAF rules may miss obfuscated payloads and that removing plugins can affect site functionality. If no timely update ships, consider switching to an alternative maintained theme, weighing the layout/functionality migration cost.