What is the CVSS score of EUVD-2026-37471?

EUVD-2026-37471 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Kapee Theme are affected by EUVD-2026-37471?

The Kapee WordPress theme contains a high-severity vulnerability (CVSS 8.1) allowing unauthenticated remote attackers to inject malicious code and compromise site integrity without requiring…. A patch is available.

How to fix or mitigate EUVD-2026-37471?

Within 24 hours: Inventory all WordPress sites running Kapee theme versions prior to 1.7.0 and review access logs for exploitation indicators. Within 7 days: Deploy Kapee 1.7.0 to all affected instances after validation in staging environments. Within 30 days: Confirm patch compliance across all sites, audit for any compromised credentials or unauthorized code, and enable object deserialization monitoring.

Kapee Theme EUVD-2026-37471

| CVE-2026-39446 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization Kapee

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Unauthenticated network-reachable PHP object injection (PR:N/AV:N) with full CIA impact; AC:H reflects need for a viable POP gadget chain to weaponize.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:41 vuln.today

Patch available

Jun 16, 2026 - 23:02 EUVD

DescriptionCVE.org

Unauthenticated PHP Object Injection in Kapee < 1.7.0 versions.

AnalysisAI

Unauthenticated PHP object injection in the Kapee WordPress theme versions prior to 1.7.0 allows remote attackers to inject crafted serialized objects that, when combined with suitable gadget chains, can lead to high-impact compromise of confidentiality, integrity, and availability. The flaw was reported by Patchstack and a vendor patch is available; no public exploit identified at time of analysis, but the unauthenticated network vector makes this a meaningful priority for sites running this commercial WooCommerce theme.

Technical ContextAI

Kapee is a commercial WooCommerce/WordPress theme by PressLayouts (CPE cpe:2.3:a:presslayouts:kapee). The root cause is CWE-502 (Deserialization of Untrusted Data): PHP's unserialize() reconstructs objects and invokes magic methods such as __wakeup, __destruct, or __toString. When attacker-controlled input reaches unserialize(), an attacker can stage a POP (property-oriented programming) gadget chain using classes loaded by WordPress core, WooCommerce, or other active plugins to achieve arbitrary file write, SQL injection, or remote code execution depending on available gadgets in the runtime.

RemediationAI

Upgrade the Kapee theme to version 1.7.0 or later, which the input data confirms as a vendor-released patch; consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/kapee/vulnerability/wordpress-kapee-theme-1-7-0-php-object-injection-vulnerability for upgrade guidance. If immediate upgrade is not possible, deploy a WAF rule (Patchstack, Wordfence, or equivalent) to block requests containing serialized PHP payloads (patterns such as O:, a:, s: in suspicious parameters) targeting Kapee theme endpoints - note this may produce false positives on legitimate serialized cookies or AJAX traffic. Audit and disable unused plugins to shrink the available POP gadget surface, and ensure WordPress core and WooCommerce are fully patched so that known gadget chains are unavailable; trade-off is potential feature loss from disabled plugins.