What is the CVSS score of CVE-2026-65576?

CVE-2026-65576 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Adrena are affected by CVE-2026-65576?

The Adrena WordPress theme (versions ≤1.2.14) contains a critical unauthenticated remote code injection vulnerability (CVE-2026-65576, CVSS 9.8) with no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-65576?

Within 24 hours: Inventory all WordPress installations running Adrena theme versions 1.2.14 and earlier; review web server and application logs for exploitation attempts targeting theme files; prepare incident response procedures and backup restoration plans. Within 7 days: Migrate critical websites to an alternative WordPress theme or obtain vendor confirmation of patch availability; test theme removal and data integrity in staging environment; document rollback procedures. Within 30 days: Complete migration for all affected sites; deploy Web Application Firewall (WAF) rules to block PHP object injection patterns; establish continuous monitoring for Patchstack security advisories and Adrena theme updates.

Adrena CVE-2026-65576

EUVD-2026-53994 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-06 Patchstack

GHSA-vwq7-f8p8-h8fh

PHP WordPress Deserialization Adrena Wordpress Theme Ancorathemes

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable deserialization with no user interaction (AV:N/AC:L/PR:N/UI:N); High C/I/A assumed given a reachable POP gadget chain enabling code/data compromise.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:47 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the Adrena WordPress theme (AncoraThemes) affects all versions up to and including 1.2.14, allowing remote attackers with no authentication to inject crafted serialized PHP objects that are deserialized by the theme. Exploitation can lead to full compromise (confidentiality, integrity and availability all High) when a suitable gadget chain is present in the WordPress core, an active plugin, or another theme. This flaw carries a CVSS 9.8 rating and was disclosed by Patchstack; no public exploit code has been identified and it is not listed in CISA KEV, so there is no public exploit identified at time of analysis.

Technical ContextAI

The vulnerability is a CWE-502 (Deserialization of Untrusted Data) issue in a WordPress theme built on PHP. PHP Object Injection arises when attacker-controlled input reaches an unserialize() call (or equivalent), letting an attacker instantiate arbitrary PHP objects with attacker-chosen properties. On its own, object injection is only exploitable if a 'gadget' - a class implementing magic methods such as __wakeup(), __destruct(), or __toString() - exists in the loaded code base; in the WordPress ecosystem such gadgets are commonly supplied by core, popular plugins, or other themes (POP chains). The affected component is identified by CPE cpe:2.3:a:ancorathemes:adrena, a commercial premium theme, and the tags (Deserialization, PHP, Adrena) confirm the deserialization root cause. No specific vulnerable function or entry point is named in the provided intelligence.

RemediationAI

No vendor-released patch version was identified in the provided intelligence, so a confirmed fix release cannot be cited; administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/adrena/vulnerability/wordpress-adrena-theme-1-2-14-php-object-injection-vulnerability) and the AncoraThemes/ThemeForest product page for any release newer than 1.2.14 and upgrade to it immediately once available. Until a patched version is confirmed, apply compensating controls: deploy a WordPress WAF (Patchstack or equivalent) with a virtual patch/rule for this vulnerability; restrict or block untrusted access to the theme's entry points and any endpoints that accept serialized input; and audit installed plugins/themes to reduce available POP gadget chains, since removing gadget-bearing components can neutralize object injection even when the injection point remains. Each of these is a stopgap - a WAF rule can be bypassed and disabling components may break site functionality - so they should be paired with monitoring of admin-ajax, REST, and theme request logs, and replaced by the official update as soon as it ships.