What is the CVSS score of EUVD-2026-15854?

EUVD-2026-15854 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Borgholm are affected by EUVD-2026-15854?

CVE-2026-32502 presents critical security risk, a insecure deserialization vulnerability rated CVSS 9.8.

How to fix or mitigate EUVD-2026-15854?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Restrict deserialization to trusted data sources and implement integrity checks.

Borgholm EUVD-2026-15854

| CVE-2026-32502 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-03-25 Patchstack

Deserialization Borgholm

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15854

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Select-Themes Borgholm borgholm-marketing-agency-theme allows Object Injection.This issue affects Borgholm: from n/a through < 1.6.

AnalysisAI

A deserialization of untrusted data vulnerability exists in Select-Themes Borgholm marketing agency theme (WordPress) that allows object injection attacks. The vulnerability affects Borgholm versions prior to 1.6, and attackers can exploit this to inject malicious PHP objects that execute arbitrary code within the WordPress environment. While no CVSS score or EPSS data is currently available, the CWE-502 classification indicates this is a critical deserialization flaw with high exploitation potential; no active KEV or public POC status is documented, but the vulnerability was reported through Patchstack with full advisory details available.

Technical ContextAI

The vulnerability stems from CWE-502 (Deserialization of Untrusted Data), a foundational class of attacks where PHP's unserialize() function or similar object deserialization mechanisms process attacker-controlled input without validation. In the Borgholm theme context (cpe:2.3:a:select-themes:borgholm:*:*:*:*:*:*:*:*), this likely occurs in theme configuration handling, AJAX handlers, or post meta processing where serialized PHP objects from user input, cookies, or database records are reconstructed into live objects. WordPress-based object injection commonly exploits magic methods (__wakeup, __destruct, __toString) in WordPress plugins or theme classes to achieve remote code execution. The Borgholm theme's PHP backend does not properly sanitize or validate serialized data before deserialization, enabling attackers to craft malicious serialized gadget chains.

RemediationAI

Immediately upgrade the Borgholm theme to version 1.6 or later using the WordPress theme update mechanism (Appearance → Themes → Updates). Verify the upgrade completion and clear any cached serialized data from the WordPress database if the theme stores persistent serialized objects. As a secondary control, disable unserialize() calls on untrusted input by implementing WordPress security plugins (such as Wordfence or Sucuri) that monitor for object injection patterns in real-time. If immediate patching is not possible, restrict access to the theme's AJAX endpoints and form handlers via Web Application Firewall rules blocking requests with suspicious serialization patterns (detecting PHP object markers like 'O:' prefix in POST/GET data). Review and audit any custom code that calls unserialize() on user input, POST data, or database values not under exclusive application control.