What is the CVSS score of EUVD-2026-37479?

EUVD-2026-37479 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of NeoBeat WordPress Theme are affected by EUVD-2026-37479?

The NeoBeat WordPress theme versions 1.7 and earlier contains an unauthenticated PHP object injection vulnerability (CVE-2026-39557, CVSS 8.1) that exposes WordPress sites to remote compromise of…

How to fix or mitigate EUVD-2026-37479?

Within 24 hours: Inventory all WordPress installations for NeoBeat theme versions ≤1.7 and immediately disable or replace with an actively maintained alternative theme. Within 7 days: Complete theme migration across all instances, update WordPress core and plugins to latest versions, and deploy Web Application Firewall rules targeting PHP serialization attack patterns. Within 30 days: Audit for signs of prior compromise, document all vulnerable theme dependencies, and establish ongoing monitoring for any vendor patch release.

NeoBeat WordPress Theme EUVD-2026-37479

| CVE-2026-39557 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization Neobeat

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated unserialize sink (AV:N/PR:N/UI:N); AC:H because impact depends on a usable PHP gadget chain; full C/I/A on successful RCE.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:37 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in NeoBeat <= 1.7 versions.

AnalysisAI

Unauthenticated PHP Object Injection in the NeoBeat WordPress theme (versions ≤1.7) allows remote attackers to inject crafted serialized objects that, when deserialized by the application, can be chained with available gadgets to compromise the site. No public exploit identified at time of analysis, but the CVSS 8.1 rating reflects high impact across confidentiality, integrity and availability if a usable gadget chain is present in the WordPress core or installed plugins.

Technical ContextAI

NeoBeat is a commercial WordPress theme distributed by Elated-Themes (CPE cpe:2.3:a:elated-themes:neobeat). The root cause is CWE-502 (Deserialization of Untrusted Data): PHP's unserialize() is invoked on attacker-controllable input without integrity checks, allowing attackers to instantiate arbitrary PHP objects. On WordPress, such injection points are routinely chained with magic methods (__wakeup, __destruct, __toString) in loaded plugins/themes to achieve file writes, SQLi, or RCE - a pattern Patchstack has catalogued repeatedly across themes that pass user input through unserialize() or unsafe wrappers like maybe_unserialize().

RemediationAI

Upstream fix available per Patchstack advisory; a released patched version is not independently confirmed in the provided data, so administrators should consult the Patchstack advisory (https://patchstack.com/database/wordpress/theme/neobeat/vulnerability/wordpress-neobeat-theme-1-7-php-object-injection-vulnerability) and Elated-Themes to obtain any post-1.7 release and update immediately. Until a confirmed patched version is installed, deactivate the NeoBeat theme and switch to a maintained theme (which will change the site's appearance), or front the site with a WAF such as Patchstack/Wordfence with virtual-patching rules for PHP object injection (may produce false positives on legitimate serialized payloads). As a hardening measure, audit installed plugins for known POP gadget chains and remove unused ones to shrink the gadget surface, accepting the loss of any functionality they provide.