What is the CVSS score of EUVD-2026-37470?

EUVD-2026-37470 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of EmallShop Theme are affected by EUVD-2026-37470?

The EmallShop WordPress theme (versions 2.4.21 and earlier) contains an unauthenticated PHP Object Injection vulnerability (CVSS 8.1) enabling remote code execution on affected sites.

How to fix or mitigate EUVD-2026-37470?

Within 24 hours: Audit all WordPress installations to identify those running EmallShop theme versions ≤ 2.4.21 and document the count and business criticality of each. Within 7 days: Either disable the EmallShop theme and switch to an alternative, or implement WAF rules to block serialized object patterns (PHP object injection indicators) at the web application firewall. Within 30 days: Monitor vendor advisories for an available patch; if released, apply immediately. If no patch materializes, complete full theme replacement with a maintained alternative.

EmallShop Theme EUVD-2026-37470

| CVE-2026-39443 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization Emallshop

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network-reachable deserialization (AV:N/PR:N/UI:N); AC:H because impact depends on a viable POP gadget chain; full CIA impact via potential RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:41 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in EmallShop <= 2.4.21 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the EmallShop WordPress theme (versions <= 2.4.21) allows remote attackers to inject crafted serialized PHP objects that are deserialized by the application, potentially leading to remote code execution, data tampering, or denial of service when a suitable gadget chain is present. The flaw was disclosed by Patchstack (EUVD-2026-37470) and carries CVSS 8.1 (AV:N/AC:H/PR:N/UI:N) - no public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

EmallShop is a commercial WooCommerce/WordPress theme published by PressLayouts (CPE cpe:2.3:a:presslayouts:emallshop). The vulnerability is rooted in CWE-502 (Deserialization of Untrusted Data): the theme passes attacker-influenced input through PHP's unserialize() (or an equivalent like maybe_unserialize), which instantiates arbitrary classes and invokes magic methods such as __wakeup, __destruct, or __toString. In WordPress installations, the loaded plugin/theme ecosystem commonly exposes POP (Property-Oriented Programming) gadget chains - for example in Contact Form 7, WooCommerce, or core WP_HTTP classes - that an object-injection primitive can chain into file writes, SQL queries, or PHP code execution.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory does not specify a fixed version, so administrators should monitor the EmallShop changelog at PressLayouts/ThemeForest and apply the next release above 2.4.21 as soon as it is published (consult https://patchstack.com/database/wordpress/theme/emallshop/vulnerability/wordpress-emallshop-theme-2-4-21-php-object-injection-vulnerability for updates). In the interim, deploy a WAF rule (Patchstack vPatch, Wordfence, or equivalent) that blocks requests containing serialized PHP payloads (patterns such as O:\d+:"...", a:\d+:{...}) against EmallShop endpoints, restrict access to the affected theme handlers via .htaccess or nginx location blocks, audit installed plugins to remove ones known to contribute object-injection gadget chains (e.g., outdated Contact Form 7, older WooCommerce extensions), and consider temporarily switching the active theme on high-value sites - accepting the trade-off of broken storefront layout - until a patched version ships.