CVE Intelligence
Analysis AI-assisted

CVE-2026-22507: AncoraThemes Beelove WordPress Theme - PHP Object Injection

A PHP Object Injection flaw (CWE-502) in the AncoraThemes Beelove WordPress theme affects versions up to and including 1.2.6, according to the Patchstack CNA record. The record rates it critical with CVSS 9.8. No fixed version is listed in the sources consulted, and the CVE is not in the CISA KEV catalog.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The Patchstack CNA record describes a PHP Object Injection issue in the Beelove theme by AncoraThemes for WordPress, classified as CWE-502 (Deserialization of Untrusted Data). The record states that versions up to and including 1.2.6 are affected.

Impact

The record scores the issue at CVSS 9.8 (critical), with a network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability. Object injection flaws of this kind can let an attacker influence application behavior when untrusted data is deserialized. The practical outcome depends on the application code and available classes, which the sources do not detail.

Affected products and versions

  • Product: AncoraThemes Beelove, a theme for WordPress
  • Affected: up to and including 1.2.6; the earliest affected version is not specified (shown as n/a)
  • Fixed version: none listed in the sources consulted

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed exploitation appears in the sources consulted. The record gives an EPSS probability of 0.00529 with a percentile of 0.43942, and an SSVC exploitation value of none.

Remediation and mitigation

  • Identify all sites running the Beelove theme and confirm the installed version.
  • Check the Patchstack entry and vendor channels for an updated release, and apply any fix as soon as one is confirmed, since the sources list no fixed version.
  • While no fix is confirmed, consider limiting exposure of affected sites, reviewing whether the theme is still needed, and replacing or disabling it if the risk is not acceptable.
  • Keep WordPress core, plugins and themes updated, and maintain tested backups.

Detection guidance

  • Review theme inventories and file integrity for the Beelove theme.
  • Monitor web server and application logs for unusual requests to theme components and for unexpected errors related to data deserialization.
  • Review administrator accounts and recent changes to content and configuration.

Limitations of the available information

The record does not give the lower bound of affected versions, a fixed version, or technical details of the vulnerable code path. The EPSS date in the record (2026-10-23) is later than the publication date, so the EPSS figures should be rechecked against a current source. This analysis relies only on the cited sources.

Frequently asked questions

Which versions of the Beelove theme are affected?

According to the record, versions up to and including 1.2.6 are affected. The earliest affected version is not specified.

Is a fixed version available?

The sources consulted do not list a fixed version. Check the Patchstack entry and the vendor for an update before assuming one exists.

Is this vulnerability being actively exploited?

The CVE is not in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.