What is the CVSS score of CVE-2026-65579?

CVE-2026-65579 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Agricola are affected by CVE-2026-65579?

The Agricola WordPress theme (versions ≤1.21.0 by AxiomThemes) contains a critical unauthenticated remote code execution vulnerability via PHP object injection that affects any WordPress installation…

How to fix or mitigate CVE-2026-65579?

Within 24 hours: Inventory all WordPress installations running Agricola theme version 1.21.0 or earlier and document business criticality of each site. Within 7 days: Disable the Agricola theme immediately and migrate to an alternative WordPress theme, deploy Web Application Firewall rules to block requests containing serialized PHP object patterns, and apply access restrictions to any remaining affected systems. Within 30 days: Monitor AxiomThemes for vendor-released patches; conduct forensic analysis of affected systems to detect prior exploitation; implement endpoint detection and response monitoring for related file operation and SQL manipulation activities; communicate remediation status to stakeholders and document all affected systems for future compliance reporting.

Agricola CVE-2026-65579

EUVD-2026-53878 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-08-06 Patchstack

GHSA-ccgm-8j36-5mhx

PHP WordPress Deserialization Agricola Wordpress Theme Axiomthemes

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network vector (PR:N/AV:N), but exploitation to high impact depends on an available POP gadget chain, warranting AC:H rather than AC:L.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:46 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

CRITICAL 9.8

DescriptionCVE.org

Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.

AnalysisAI

PHP Object Injection in the Agricola WordPress theme (versions ≤ 1.21.0 by AxiomThemes) lets unauthenticated remote attackers inject crafted serialized PHP objects that are deserialized by the application, and with a suitable POP gadget chain this can escalate to arbitrary file operations, SQL manipulation, or remote code execution. Rated CVSS 9.8 and disclosed by Patchstack (EUVD-2026-53878), it requires no authentication or user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

Agricola is a commercial WordPress theme distributed by AxiomThemes (CPE cpe:2.3:a:axiomthemes:agricola). The flaw is a CWE-502 Deserialization of Untrusted Data weakness: attacker-controlled input reaches a PHP unserialize() call without validation. In WordPress theme contexts this typically occurs when request parameters, cookies, or option values are passed to unserialize(). Successful exploitation depends on the presence of a POP (Property-Oriented Programming) gadget chain - magic methods such as __wakeup(), __destruct(), or __toString() in the theme, WordPress core, or any active plugin - that the injected object can drive toward a harmful sink. Because WordPress ships numerous classes and sites run many plugins, usable gadget chains are frequently available, which is why object injection in WordPress is commonly treated as a high-impact primitive.

RemediationAI

Upgrade the Agricola theme to a release newer than 1.21.0 once AxiomThemes publishes a patched version; no exact fix version is identified in the available data, so consult the vendor and the Patchstack advisory (https://patchstack.com/database/wordpress/theme/agricola/vulnerability/wordpress-agricola-theme-1-21-0-php-object-injection-vulnerability) for the fixed release. Until a patched build is confirmed and applied, place the site behind a WAF with virtual-patching rules for PHP object injection (Patchstack offers such rules), block or filter requests containing serialized-object markers (for example strings matching O:<digits>: or a:<digits>:) to the theme's endpoints, and remove or deactivate the Agricola theme if it is not essential. These input-filtering controls can produce false positives on legitimate serialized data and may break functionality, so test before enforcing.