What is the CVSS score of EUVD-2026-15679?

EUVD-2026-15679 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Meloo are affected by EUVD-2026-15679?

The Rascals Meloo WordPress theme contains a PHP object injection vulnerability (CVE-2026-25358) that enables remote code execution through unsafe deserialization, affecting all installations running…. A patch is available.

How to fix or mitigate EUVD-2026-15679?

Within 24 hours: Inventory all WordPress installations using Rascals Meloo theme and identify current version numbers. Within 7 days: Update Rascals Meloo theme to version 2.8.2 or later on all affected WordPress sites; test functionality in staging environment before production deployment. Within 30 days: Conduct security audit of affected WordPress instances for indicators of compromise or unauthorized object injection attempts.

Meloo EUVD-2026-15679

| CVE-2026-25358 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

Deserialization Meloo

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

Analysis Updated

Apr 16, 2026 - 06:15 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

2.8.2

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15679

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in rascals Meloo meloo allows Object Injection.This issue affects Meloo: from n/a through < 2.8.2.

AnalysisAI

A PHP Object Injection vulnerability exists in the Rascals Meloo WordPress theme due to unsafe deserialization of untrusted data, classified under CWE-502 (Deserialization of Untrusted Data). This vulnerability affects Meloo versions prior to 2.8.2 and allows attackers to inject malicious objects that could lead to remote code execution or other security compromises. While no CVSS score, EPSS probability, or KEV status has been publicly assigned, the vulnerability was reported by Patchstack and has been assigned ENISA EUVD tracking ID EUVD-2026-15679, indicating active monitoring by European vulnerability databases.

Technical ContextAI

The vulnerability stems from improper handling of PHP object serialization and deserialization mechanisms within the Meloo theme (CPE: cpe:2.3:a:rascals:meloo:*:*:*:*:*:*:*:*). CWE-502 specifically addresses the unsafe use of PHP's unserialize() function or similar deserialization routines when processing untrusted input—such as user-supplied data from POST parameters, cookies, or stored database content. WordPress themes like Meloo that handle theme options, user-generated content, or plugin data without proper input validation are particularly susceptible to this class of vulnerability, as attackers can craft malicious serialized PHP objects (gadget chains) that, when unserialized, trigger arbitrary code execution through the magic methods and property accessors available in the WordPress ecosystem.

RemediationAI

Immediately upgrade the Rascals Meloo theme to version 2.8.2 or later through the WordPress admin dashboard (Appearance > Themes > Updates) or by downloading the patched version directly from the vendor. Verify the upgrade completion by checking the theme version in Appearance > Themes and confirming it displays version 2.8.2 or higher. As a temporary mitigation for environments unable to upgrade immediately, disable or remove the Meloo theme if not actively in use, restrict administrative access to WordPress to trusted IP addresses only, and audit WordPress user accounts to remove any suspicious or unnecessary users. For defense-in-depth, implement WordPress security hardening measures such as disabling plugin/theme editing (set DISALLOW_FILE_EDIT to true in wp-config.php) and installing a Web Application Firewall (WAF) to detect and block serialized object injection attempts. See the Patchstack advisory for additional technical details.