EUVD-2026-37491Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable unauthenticated deserialization with no user interaction; AC:H reflects required PHP gadget chain; full CIA impact via RCE on the WordPress host.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated PHP Object Injection in Esmée <= 1.4 versions.
AnalysisAI
Unauthenticated PHP object injection in the Mikado Themes 'Esmée' WordPress theme (versions through 1.4) allows remote attackers to inject crafted serialized objects that are processed by unsafe deserialization. Exploitation depends on the presence of usable PHP gadget chains (often from WordPress core or co-installed plugins/themes), and no public exploit identified at time of analysis, but successful attacks can lead to file write, SQL manipulation, or remote code execution on the underlying site. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be running the Mikado-Themes 'Esmée' WordPress theme at version 1.4 or earlier with a network-reachable endpoint that deserializes attacker-controlled input via PHP unserialize(); no WordPress authentication is required (PR:N) and no user interaction is required (UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS vector AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H indicates a remotely reachable, unauthenticated sink with full CIA impact, but the High attack complexity flag signals that successful exploitation depends on conditions outside the attacker's direct control - almost certainly the presence of a usable PHP gadget chain in the victim environment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends an HTTP request to a public Esmée theme endpoint with a crafted serialized PHP object in a parameter, cookie, or form field that the theme passes to unserialize(). When PHP instantiates the object, a gadget chain assembled from WordPress core or other installed components fires via magic methods, leading to arbitrary file write or code execution and full site compromise. … |
| Remediation | No vendor-released patch identified at time of analysis: the advisory only specifies affected versions ≤ 1.4 with no fixed version listed in the provided data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all WordPress installations running 'Esmée' theme versions 1.4 and earlier; restrict public access to affected sites if operationally feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Stored cross-site scripting in the StarCitizenWiki EmbedVideo MediaWiki extension (versions <= 4.0.0) allows any user wi
Unrestricted PHP file upload in the MagicForm WordPress plugin (through version 0.1.3) enables unauthenticated remote co
Remote unauthenticated arbitrary file upload in JoomShaper SP Page Builder extension for Joomla (versions 1.0.0 through
Arbitrary PHP file upload in the iCagenda extension for Joomla enables remote unauthenticated attackers to abuse the eve
Unauthenticated PHP Object Injection in the ThemeREX Hot Coffee WordPress theme (versions ≤ 1.7) allows remote attackers
Share
External POC / Exploit Code
Leaving vuln.today