What is the CVSS score of EUVD-2026-37488?

EUVD-2026-37488 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Roisin WordPress Theme are affected by EUVD-2026-37488?

The Roisin WordPress theme (versions 1.4 and earlier) contains an unauthenticated remote code execution vulnerability (CVE-2026-40754, CVSS 8.1) allowing attackers to completely compromise affected…

How to fix or mitigate EUVD-2026-37488?

Within 24 hours: Audit all WordPress installations for Roisin theme version 1.4 or earlier; disable or isolate affected sites. Within 7 days: Deploy alternative WordPress theme with testing in staging environment; implement WAF rules to block PHP object injection attacks. Within 30 days: Complete theme migration across production systems; verify Roisin theme removal; establish automated scanning for WordPress theme and plugin vulnerabilities.

Roisin WordPress Theme EUVD-2026-37488

| CVE-2026-40754 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization Roisin

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable unauthenticated theme endpoint (AV:N/PR:N/UI:N); AC:H because exploitation depends on a site-specific POP gadget chain; full C/I/A impact via RCE-class object injection.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 16, 2026 - 23:31 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Roisin <= 1.4 versions.

AnalysisAI

Unauthenticated PHP object injection in the Roisin WordPress theme (versions up to and including 1.4) by elated-themes allows remote attackers to deliver crafted serialized payloads to vulnerable deserialization sinks, potentially leading to high-impact compromise of confidentiality, integrity, and availability. The CVSS 8.1 score reflects high attack complexity offset by the lack of any authentication or user interaction. No public exploit was identified at time of analysis, and the issue is tracked by Patchstack and ENISA (EUVD-2026-37488).

Technical ContextAI

PHP object injection (CWE-502: Deserialization of Untrusted Data) occurs when unserialize() or equivalent calls process attacker-controlled input without validation, instantiating arbitrary classes and invoking magic methods such as __wakeup, __destruct, or __toString. In WordPress themes, this typically manifests through theme options, AJAX handlers, or front-end form processing that pass user-supplied data to unserialize(). Exploitation in WordPress relies on POP (Property-Oriented Programming) gadget chains assembled from classes loaded in the WordPress core, active plugins, or the theme itself; the resulting impact ranges from file read/write to remote code execution depending on the available gadgets. The CPE cpe:2.3:a:elated-themes:roisin identifies the Roisin commercial premium theme as the sole affected product.

RemediationAI

No vendor-released patch identified at time of analysis; site operators should monitor the elated-themes vendor channel and the Patchstack advisory (https://patchstack.com/database/wordpress/theme/roisin/vulnerability/wordpress-roisin-theme-1-4-php-object-injection-vulnerability) for an updated Roisin release above 1.4 and upgrade immediately when available. Until a fix ships, consider deploying a virtual patch via Patchstack or a WAF rule that blocks requests containing serialized PHP object markers (e.g. parameters matching the pattern O:\d+:" or a:\d+:{) targeting theme endpoints, accepting that this can break legitimate functionality that relies on serialized data. As a higher-impact compensating control, temporarily switch the active theme away from Roisin or restrict access to theme-handled endpoints (admin-ajax.php, theme AJAX routes) at the network or reverse-proxy layer; both measures degrade site features but eliminate the attack surface entirely.