EUVD-2026-15854Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in Select-Themes Borgholm borgholm-marketing-agency-theme allows Object Injection.This issue affects Borgholm: from n/a through < 1.6.
AnalysisAI
A deserialization of untrusted data vulnerability exists in Select-Themes Borgholm marketing agency theme (WordPress) that allows object injection attacks. The vulnerability affects Borgholm versions prior to 1.6, and attackers can exploit this to inject malicious PHP objects that execute arbitrary code within the WordPress environment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Remote unauthenticated attacker can exploit Select-Themes Borgholm marketing agency theme versions before 1.6 via deserialization of untrusted data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Despite the absence of a CVSS vector and EPSS score, this vulnerability carries substantial real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker could craft a malicious serialized PHP object and inject it through a public-facing form field, comment parameter, or AJAX handler in a Borgholm-powered marketing website. Upon deserialization by the vulnerable theme, the object's magic methods trigger a gadget chain that executes arbitrary PHP code with WordPress admin privileges, potentially leading to website defacement, malware installation, or data exfiltration. … |
| Remediation | Immediately upgrade the Borgholm theme to version 1.6 or later using the WordPress theme update mechanism (Appearance → Themes → Updates). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all affected systems and apply vendor patches immediately. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today