What is the CVSS score of EUVD-2026-33924?

EUVD-2026-33924 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Askka WordPress Theme are affected by EUVD-2026-33924?

The Askka WordPress theme (versions through 1.3.1) from Elated-Themes contains a PHP object injection flaw that could allow attackers to achieve complete website compromise, including unauthorized…

How to fix or mitigate EUVD-2026-33924?

Within 24 hours: Conduct full inventory of WordPress installations running Askka theme v1.3.1 or earlier; prioritize sites handling sensitive data or serving customers. Within 7 days: Deactivate and completely remove Askka theme from all affected installations; deploy alternative WordPress theme with current security maintenance. Within 30 days: Perform comprehensive security audit of all previously affected sites to confirm no unauthorized code injection occurred; implement Web Application Firewall rules to block PHP object deserialization attacks across WordPress infrastructure.

Askka WordPress Theme EUVD-2026-33924

| CVE-2026-39555 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-02 audit@patchstack.com

GHSA-w594-jcp9-58h9

WordPress Deserialization Wordpress Theme

8.1

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (patchstack) · only source for this CVE.

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 14:35 vuln.today

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Elated-Themes Askka allows Object Injection.

This issue affects Askka: from n/a through 1.3.1.

AnalysisAI

PHP object injection in the Elated-Themes Askka WordPress theme through version 1.3.1 allows remote attackers to deserialize untrusted data, potentially leading to arbitrary code execution, file manipulation, or full site compromise depending on available gadget chains. The CVSS score of 8.1 reflects high impact across confidentiality, integrity, and availability, though high attack complexity (AC:H) tempers immediate exploitability. No public exploit identified at time of analysis.

Technical ContextAI

The vulnerability stems from CWE-502 (Deserialization of Untrusted Data), where the Askka theme passes attacker-controllable input to PHP's unserialize() or an equivalent deserialization routine without first validating or sanitizing it. In the WordPress ecosystem, object injection issues are typically exploited via reusable gadget chains present in WordPress core, popular plugins, or bundled libraries (such as Monolog, Guzzle, or Composer dependencies), which can be chained into POP (Property-Oriented Programming) sequences resulting in arbitrary file write, SQL injection, RCE, or sensitive data exposure. Elated-Themes themes commonly bundle the Qode framework and shared premium plugins (e.g., Revolution Slider, WPBakery), expanding the gadget surface available to attackers.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack record describes versions up to and including 1.3.1 as vulnerable with no fixed version cited. Site operators should monitor the vendor's ThemeForest/Elated-Themes channels and the Patchstack advisory (https://patchstack.com/database/wordpress/theme/askka/vulnerability/wordpress-askka-theme-1-3-1-php-object-injection-vulnerability) for an updated release, and in the interim enable Patchstack's virtual patching or a WAF with rules to block serialized PHP payloads (strings beginning with 'O:' or 'a:' in request parameters) targeting theme endpoints - note this may break legitimate functionality that relies on serialized cookies or POST data. As a stronger containment, deactivate the Askka theme and switch to a maintained theme until a fix is released; restricting access to wp-admin via IP allowlisting reduces but does not eliminate the unauthenticated attack surface.