Description
Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.
Published: 2026-08-06
Score: 9.8 Critical
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Unvalidated deserialization in WordPress Abelle theme versions 1.22 and earlier allows an unauthenticated attacker to send crafted PHP serialized objects, giving the ability to instantiate arbitrary PHP classes and execute code. The flaw is classified as CWE-502. Successful exploitation would compromise the confidentiality, integrity, and availability of the affected site, enabling full control over the WordPress installation.

Affected Systems

The vulnerability affects WordPress sites that have the ThemeREX Abelle theme installed with a version of 1.22 or earlier.

Risk and Exploitability

With a CVSS score of 9.8, this vulnerability is considered Critical. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The likely attack vector is a web request to the affected theme’s components, which does not require authentication and can be automated by malicious actors.

Generated by OpenCVE AI on August 6, 2026 at 16:12 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Abelle theme to a version newer than 1.22 to remove the deserialization vulnerability
  • If an immediate update is not possible, temporarily refactor or comment out all calls to ‘unserialize’ in the theme’s code or sanitize any input that reaches those calls
  • Deploy a Web Application Firewall rule or IDS signature that blocks typical PHP serialized payloads to reduce the attack surface

Generated by OpenCVE AI on August 6, 2026 at 16:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 06 Aug 2026 17:15:00 +0000

Type Values Removed Values Added
First Time appeared Themerex
Themerex abelle
Wordpress
Wordpress wordpress
Vendors & Products Themerex
Themerex abelle
Wordpress
Wordpress wordpress

Thu, 06 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
Description Unauthenticated PHP Object Injection in Abelle <= 1.22 versions.
Title WordPress Abelle theme <= 1.22 - PHP Object Injection vulnerability
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Themerex Abelle
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-08-06T14:27:42.873Z

Reserved: 2026-07-22T08:54:37.139Z

Link: CVE-2026-65573

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-06T17:00:10Z

Weaknesses
  • CWE-502

    Deserialization of Untrusted Data