CVE-2026-65577 - Vulnerability Details

Description

Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.

Published: 2026-08-06

Score: 9.8 Critical

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is an unauthenticated PHP Object Injection flaw in the Advice WordPress theme up to version 1.18.0, allowing malicious serialized data to be processed without proper validation and potentially leading to arbitrary code execution and full compromise of the web application.

Affected Systems

WordPress sites that have the Advice theme installed from AncoraThemes, version 1.18.0 or earlier, are affected. No other plugins or theme versions are mentioned as impacted.

Risk and Exploitability

The CVSS score of 9.8 indicates a severe risk, while the EPSS score is not available, leaving the exploitation probability uncertain. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote: an attacker can send crafted serialized payloads to an endpoint of the theme without authentication, triggering the injection.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

AncoraThemes

Advice

unaffected

Version	Status	Constraints
`n/a`	affected	≤ 1.18.0

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Advice theme to any version newer than 1.18.0 or apply the vendor’s official patch.
If the upgrade cannot be performed immediately, deactivate or remove the Advice theme entirely from the WordPress installation to eliminate the vulnerable code path.
Reduce the risk of similar issues by ensuring that any future theme or plugin development follows proper input validation and avoids deserializing untrusted data; refer to CWE‑502 best practices.

Generated by OpenCVE AI on August 6, 2026 at 16:12 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://patchstack.com/database/wordpress/theme/advice/vulnerability/wordpress-advice-theme-1-18-0-php-object-injection-vulnerability?_s_id=cve

History

Thu, 06 Aug 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 06 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Description		Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.
Title		WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability
Weaknesses		CWE-502
References		https://patchstack.com/database/wordpress/theme/advice/vulnerability/wordpress-advice-theme-1-18-0-php-object-injection-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Subscriptions

No data.

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2026-08-06T14:27:45.567Z

Updated: 2026-08-06T14:27:45.567Z

Reserved: 2026-07-22T08:54:37.139Z

Link: CVE-2026-65577

Vulnrichment

Updated: 2026-08-06T16:53:32.448Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-08-06T16:15:12Z

Weaknesses

CWE-502
Deserialization of Untrusted Data

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-65577", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-07-22T08:54:37.139Z", "datePublished": "2026-08-06T14:27:45.567Z", "dateUpdated": "2026-08-06T16:53:37.665Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-08-06T14:27:45.567Z"}, "title": "WordPress Advice theme <= 1.18.0 - PHP Object Injection vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "CAPEC-586 Object Injection"}]}], "affected": [{"vendor": "AncoraThemes", "collectionURL": "https://wordpress.org/themes", "defaultStatus": "unaffected", "packageName": "advice", "product": "Advice", "versions": [{"lessThanOrEqual": "1.18.0", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions."}], "value": "Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions."}], "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/theme/advice/vulnerability/wordpress-advice-theme-1-18-0-php-object-injection-vulnerability?_s_id=cve"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Bonds | Patchstack Bug Bounty Program"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-65577", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-08-06T16:53:27.385632Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-06T16:53:32.448Z"}}]}}

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object