What is the CVSS score of EUVD-2026-41322?

EUVD-2026-41322 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Themify Popup are affected by EUVD-2026-41322?

The Themify Popup WordPress plugin (versions through 1.4.3) contains a PHP object injection vulnerability (CVE-2026-56037, CVSS 8.8) permitting authenticated users to execute arbitrary code on…

How to fix or mitigate EUVD-2026-41322?

24 hours: Audit and document all WordPress instances running Themify Popup through version 1.4.3; review and restrict administrator and editor account access to only trusted personnel. 7 days: Deactivate the Themify Popup plugin if operationally feasible; deploy WAF rules to monitor and block suspicious POST requests to plugin endpoints. 30 days: Monitor Patchstack and the official Themify Popup repository for availability of patched version 1.4.4 or later; prepare and test production patch deployment procedures; verify remediation across all affected systems.

Themify Popup EUVD-2026-41322

| CVE-2026-56037 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-07-02 audit@patchstack.com

GHSA-2vg7-9fw4-fmph

WordPress Deserialization Wordpress Plugin

8.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable plugin endpoint (AV:N/AC:L) needs a low-privilege authenticated account (PR:L) and no interaction (UI:N); object injection can yield full RCE, so C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:31 vuln.today

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Themify Themify Popup allows Object Injection.

This issue affects Themify Popup: from n/a through 1.4.3.

AnalysisAI

PHP Object Injection in the Themify Popup WordPress plugin (all versions through 1.4.3) lets an authenticated attacker pass attacker-controlled serialized data into an unsafe deserialization sink (CWE-502), instantiating arbitrary PHP objects. Combined with a suitable gadget chain in the plugin, WordPress core, or other installed code, this can escalate to remote code execution, data theft, or site takeover. Reported by Patchstack; no public exploit is identified at time of analysis and it is not on CISA KEV.

Technical ContextAI

The vulnerability is a PHP Object Injection arising from calling unserialize() (or an equivalent deserialization routine) on untrusted input within the Themify Popup plugin, which builds and displays configurable popups on WordPress sites. When PHP unserializes attacker-controlled data, it reconstructs arbitrary object instances, and any 'magic' methods (__wakeup, __destruct, __toString) on classes available in the WordPress runtime execute automatically. CWE-502 (Deserialization of Untrusted Data) is the root cause class: the flaw itself does not run code, but it hands an attacker the primitive to trigger a 'property-oriented programming' gadget chain drawn from the plugin, WordPress core, or any other loaded plugin/theme, which is how object injection typically reaches file writes, SQL, or code execution.

RemediationAI

Upgrade to a fixed release of Themify Popup newer than 1.4.3 once published by the vendor; the input does not specify an exact patched version, so consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/themify-popup/vulnerability/wordpress-themify-popup-plugin-1-4-3-php-object-injection-vulnerability?_s_id=cve) and the Themify changelog for the corrected build. No vendor-released patched version is independently confirmed at time of analysis, so if none is yet available, apply compensating controls: deactivate and remove the Themify Popup plugin if popups are non-essential (removes the sink entirely, at the cost of that functionality); tighten registration so untrusted users cannot obtain the low-privilege account the attack needs (disable open self-registration or set default role to a minimal capability); and deploy a WordPress WAF/virtual-patch rule (Patchstack or equivalent) to block serialized-object payloads to the plugin's endpoints, accepting possible false positives on legitimate serialized data.