What is the CVSS score of EUVD-2026-37482?

EUVD-2026-37482 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of Playroom WordPress Theme are affected by EUVD-2026-37482?

The Playroom WordPress theme by elated-themes (versions 1.4.1 and earlier) contains a high-severity vulnerability (CVSS 8.1) that could enable remote code execution on affected WordPress sites.

How to fix or mitigate EUVD-2026-37482?

Within 24 hours: Identify all WordPress installations using Playroom theme version 1.4.1 or earlier through automated scanning or manual inventory. Within 7 days: Deactivate and remove the Playroom theme from all affected sites, replacing it with an actively maintained alternative, and test all site functionality post-replacement. Within 30 days: Audit all WordPress themes and plugins for security currency, establish a pre-approval process for third-party WordPress extensions, and review access logs from the vulnerability window for suspicious activity.

Playroom WordPress Theme EUVD-2026-37482

| CVE-2026-39577 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization Playroom

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

8.1 HIGH

Description states unauthenticated (PR:N) over the network; AC:H because exploitation requires a usable POP gadget chain on the target; full CIA impact assumed for typical object-injection outcomes.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:35 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Playroom <= 1.4.1 versions.

AnalysisAI

PHP Object Injection in the Playroom WordPress theme (versions ≤ 1.4.1) by elated-themes allows remote attackers to inject crafted serialized objects that are deserialized by the application, potentially triggering POP-chain gadgets. The vulnerability is described as unauthenticated by Patchstack despite the CVSS vector listing PR:H, and no public exploit identified at time of analysis.

Technical ContextAI

The flaw is a CWE-502 Deserialization of Untrusted Data weakness in a commercial WordPress theme distributed by elated-themes (CPE cpe:2.3:a:elated-themes:playroom). PHP Object Injection occurs when user-controllable input reaches PHP's unserialize() function (or equivalent), enabling an attacker to instantiate arbitrary classes whose magic methods (__wakeup, __destruct, __toString) can be chained into POP gadgets present in WordPress core, bundled plugins, or theme libraries. Exploitation impact in WordPress depends heavily on which gadget chains exist in the victim site's installed code, since the theme itself only provides the injection sink.

RemediationAI

No vendor-released patch identified at time of analysis - the references describe versions ≤ 1.4.1 as vulnerable without naming a fixed release, so administrators should monitor the elated-themes vendor portal and the Patchstack advisory at https://patchstack.com/database/wordpress/theme/playroom/vulnerability/wordpress-playroom-theme-1-4-1-php-object-injection-vulnerability for a corrected build and upgrade as soon as one is published. Until a fix ships, deploy a virtual patch via the Patchstack mitigation feed or a WAF rule that blocks request parameters containing serialized PHP markers (e.g. O:\d+:", a:\d+:{) reaching theme endpoints, accepting the trade-off that legitimate serialized payloads in admin workflows may be blocked. Consider temporarily switching the active theme on production sites that do not require Playroom-specific functionality, and audit installed plugins for known POP-chain gadget classes to reduce exploitability while a patch is pending.