What is the CVSS score of CVE-2026-65578?

CVE-2026-65578 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Agora Theme are affected by CVE-2026-65578?

Websites using the Agora WordPress theme (versions 1.9 and earlier) face immediate risk of complete compromise, including data theft and service disruption, due to a critical unauthenticated remote…

How to fix or mitigate CVE-2026-65578?

Within 24 hours: Scan all WordPress installations to identify those using Agora theme by AncoraThemes versions 1.9 and below, then immediately disable the theme or implement WAF rules to block requests containing serialized PHP object patterns. Within 7 days: Either remove the theme entirely and replace with a patched alternative, or isolate affected instances behind additional access controls while implementing real-time file integrity monitoring. Within 30 days: Complete decommissioning of all Agora theme installations; if switching themes is not feasible, maintain isolation and monitoring controls until AncoraThemes releases a patched version.

Agora Theme CVE-2026-65578

EUVD-2026-53996 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-06 Patchstack

GHSA-gpgj-3x64-9wv8

PHP WordPress Deserialization Agora Wordpress Theme Ancorathemes

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated remote deserialization with no user interaction (AV:N/AC:L/PR:N/UI:N); high CIA impact assumes an exploitable gadget chain enabling code execution.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:46 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in Agora <= 1.9 versions.

AnalysisAI

PHP Object Injection in the Agora WordPress theme (by AncoraThemes) affects all versions up to and including 1.9, allowing remote unauthenticated attackers to inject serialized PHP objects that are deserialized by the application. Because exploitation requires no authentication and no user interaction over the network, a successful attack can lead to full compromise (arbitrary code execution, data theft, or site takeover) when a suitable gadget chain is present in the theme or its plugin ecosystem. Reported by Patchstack (EUVD-2026-53996); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The flaw is a classic CWE-502 (Deserialization of Untrusted Data) vulnerability in a PHP/WordPress context, tagged by Patchstack as 'Deserialization, PHP, Agora'. The affected component is the Agora commercial theme published by AncoraThemes (CPE cpe:2.3:a:ancorathemes:agora:*), which runs on the WordPress/PHP stack. PHP Object Injection occurs when attacker-controlled input reaches an unserialize() call (or equivalent), letting an attacker instantiate arbitrary PHP objects. On its own this is harmful only when a 'POP gadget' chain exists in the loaded codebase (WordPress core, the theme, or active plugins) whose magic methods (__wakeup, __destruct, __toString) perform sensitive actions such as file writes, SQL queries, or code execution - which is why POI in the WordPress ecosystem frequently escalates to RCE or arbitrary file operations.

RemediationAI

No vendor-released patch version is identified in the available data, so the primary recommendation is to consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/agora/vulnerability/wordpress-agora-theme-1-9-php-object-injection-vulnerability) and the AncoraThemes vendor channel for an updated release above 1.9, then upgrade as soon as a fixed build is published. Until a patched version is confirmed, apply compensating controls: deploy a WordPress WAF virtual patch (Patchstack or equivalent) to block PHP Object Injection payloads targeting the theme's entry points; restrict or filter the specific request parameters/endpoints that accept serialized data reaching unserialize(); audit and remove unnecessary active plugins/themes to shrink the pool of exploitable POP gadget chains (trade-off: may disable site functionality); and consider temporarily switching to an unaffected theme on high-value sites (trade-off: layout/design changes). Ensure PHP and WordPress are current so no additional gadget chains are introduced.