What is the CVSS score of EUVD-2026-13053?

EUVD-2026-13053 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by EUVD-2026-13053?

The ColorFolio Freelance Designer WordPress theme contains a critical code execution vulnerability affecting any organization using this theme on WordPress sites.

How to fix or mitigate EUVD-2026-13053?

Within 24 hours: Identify all WordPress installations using ColorFolio theme versions up to 1.3 and document inventory. Within 7 days: Implement compensating controls (WAF rules blocking suspicious serialized PHP objects, disable PHP object deserialization if possible, restrict administrative access, enable website activity monitoring). Within 30 days: Transition away from the vulnerable theme by upgrading to version 1.4+ when available or migrating to an alternative maintained WordPress theme.

WordPress EUVD-2026-13053

| CVE-2026-27096 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-19 Patchstack

Deserialization WordPress

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 19, 2026 - 06:00 euvd

EUVD-2026-13053

Analysis Generated

Mar 19, 2026 - 06:00 vuln.today

CVE Published

Mar 19, 2026 - 05:31 nvd

HIGH 8.1

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3.

AnalysisAI

The ColorFolio Freelance Designer WordPress Theme versions up to 1.3 contains a deserialization of untrusted data vulnerability that allows attackers to perform PHP Object Injection. This enables remote unauthenticated attackers to execute arbitrary code or manipulate application logic, though exploitation requires high attack complexity. There is no evidence of active exploitation (not in CISA KEV), and EPSS score data is not provided, but the vulnerability has been publicly disclosed by Patchstack.

Technical ContextAI

This vulnerability affects the ColorFolio theme developed by BuddhaThemes (CPE: cpe:2.3:a:buddhathemes:colorfolio_-_freelance_designer_wordpress_theme:*:*:*:*:*:*:*:*). The issue stems from CWE-502 (Deserialization of Untrusted Data), where the theme improperly deserializes user-controlled data without adequate validation. In PHP applications like WordPress themes, unsafe deserialization can instantiate arbitrary objects with attacker-controlled properties, leading to object injection attacks. When combined with magic methods like __wakeup(), __destruct(), or __toString(), attackers can chain these gadgets to achieve remote code execution, SQL injection, or other severe impacts. The vulnerability exists in the theme's core code up to version 1.3.

RemediationAI

Users should immediately upgrade the ColorFolio WordPress theme to a version newer than 1.3 if available from BuddhaThemes, or discontinue use of the theme if no patched version exists. Consult the Patchstack database entry at https://patchstack.com/database/wordpress/theme/colorfolio/vulnerability/wordpress-colorfolio-freelance-designer-wordpress-theme-theme-1-3-deserialization-of-untrusted-data-vulnerability?_s_id=cve for specific remediation guidance and patch availability. As an interim mitigation, implement Web Application Firewall (WAF) rules to inspect and block serialized PHP objects in HTTP requests, restrict file upload functionality, and ensure all user input undergoes strict validation before processing. Organizations should also review WordPress security hardening best practices including disabling PHP file execution in upload directories and implementing principle of least privilege for WordPress user roles.