What is the CVSS score of CVE-2026-65577?

CVE-2026-65577 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Advice WordPress Theme are affected by CVE-2026-65577?

AncoraThemes 'Advice' WordPress theme versions through 1.18.0 contain a critical unauthenticated remote code execution vulnerability with no vendor patch available.

How to fix or mitigate CVE-2026-65577?

Within 24 hours, identify all WordPress installations using AncoraThemes 'Advice' theme version 1.18.0 or earlier, immediately deactivate the affected theme across all instances, and isolate any systems unable to be remediated from production network access. Within 7 days, deploy Web Application Firewall rules to detect and block PHP object injection attempts, enable enhanced audit logging on all WordPress installations, and conduct forensic review of access logs for exploitation attempts. Within 30 days, migrate to an alternative actively-maintained WordPress theme or deploy AncoraThemes 'Advice' version 1.18.1 or later if vendor releases a patched version; validate all changes in staging environment before production deployment.

Advice WordPress Theme CVE-2026-65577

EUVD-2026-53995 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-06 Patchstack

GHSA-65pj-ch2p-3v4g

PHP WordPress Deserialization Advice Wordpress Theme Ancorathemes

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network, unauthenticated, no interaction, but full impact realistically depends on a usable POP gadget chain, warranting AC:H rather than the input's AC:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:47 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.

AnalysisAI

PHP Object Injection in the AncoraThemes 'Advice' WordPress theme (versions up to and including 1.18.0) lets unauthenticated remote attackers pass attacker-controlled serialized data into an unsafe PHP deserialization sink (CWE-502). Because a suitable POP (property-oriented programming) gadget chain in the theme or a co-installed plugin can then be triggered, this can escalate to arbitrary file operations, data disclosure, or remote code execution. Rated CVSS 9.8; reported by Patchstack, with no public exploit identified at time of analysis.

Technical ContextAI

The affected component is the 'Advice' commercial WordPress theme from vendor AncoraThemes (CPE cpe:2.3:a:ancorathemes:advice), a PHP-based presentation-layer package running inside a WordPress installation. The root cause is CWE-502, Deserialization of Untrusted Data: the theme calls PHP's unserialize() (or an equivalent) on input an attacker can influence without validating it, allowing injection of crafted PHP object structures. PHP Object Injection itself does not execute code directly - it instantiates arbitrary objects, and impact is realized when their magic methods (__wakeup, __destruct, __toString) are invoked, forming a POP gadget chain drawn from the theme, WordPress core, or any active plugin.

RemediationAI

No vendor-released patched version is identified in the provided data (the advisory establishes 1.18.0 and below as vulnerable but names no fixed release), so consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/advice/vulnerability/wordpress-advice-theme-1-18-0-php-object-injection-vulnerability?_s_id=cve) and the AncoraThemes vendor page for an update above 1.18.0 and apply it once available. As compensating controls until a fix is confirmed: deploy a WordPress WAF / virtual patch (Patchstack provides one) to block object-injection payloads reaching the theme, which adds latency and may need tuning to avoid false positives; audit and remove unnecessary plugins/themes to shrink the pool of available POP gadget chains, at the cost of feature loss; and restrict or monitor the specific theme endpoints/parameters that accept serialized input via server access rules. If the theme is not essential, switch to an unaffected theme, accepting the site-redesign effort that entails.