CVE Intelligence
Analysis AI-assisted

CVE-2026-32502: Borgholm Marketing Agency Theme - Insecure Deserialization (Object Injection)

CVE-2026-32502 is an insecure deserialization flaw (CWE-502) that allows object injection in the borgholm-marketing-agency-theme published by Select-Themes, affecting Borgholm versions below 1.6 according to the record. The CNA Patchstack scored it 9.8 (Critical) under CVSS 3.1, with network attack vector and no privileges or user interaction required. No confirmed exploitation appears in the sources consulted, and the record lacks structured affected and fixed version data.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-32502 describes a deserialization of untrusted data weakness (CWE-502) in the Borgholm marketing agency theme, published by Select-Themes. According to the record, it allows object injection and affects Borgholm versions below 1.6. The CVE was published on 2026-03-25 and the CNA is Patchstack.

Impact

  • The CNA scored the issue at CVSS 3.1 base score 9.8, rated critical, with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
  • Object injection through unsafe deserialization can, in general terms, let untrusted input influence application objects. The specific consequences in this theme are not detailed in the record.
  • The vector indicates network reachability, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability as scored by the CNA.

Affected products and versions

  • Product: Borgholm, theme borgholm-marketing-agency-theme, vendor Select-Themes.
  • Range stated in the record: from an unspecified starting version through versions below 1.6.
  • The structured affected and fixes fields in the record are empty.

Exploitation status

  • The CISA KEV catalog does not list this CVE according to the record.
  • No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00564 (percentile 0.45351), which is a statistical estimate and not evidence of exploitation.

Remediation and mitigation

  • Identify all installations of the Borgholm theme and record their versions.
  • Inference: because the stated range ends below 1.6, a version at or above 1.6 would fall outside that range. Confirm this with the vendor or the Patchstack advisory before relying on it.
  • Where updates cannot be applied promptly, limit administrative and public exposure of the affected site components as a temporary defensive measure, and review whether untrusted data reaches deserialization routines.
  • Test updates in a staging environment and keep current backups.

Detection guidance

  • Review web server and application logs for unusual requests to theme-related endpoints or unexpected parameters.
  • Monitor for unexpected changes to site files and for newly created administrative accounts.
  • Consult the Patchstack advisory for any vendor-specific indicators.

Limitations of the available information

  • The record has no title, no structured affected or fixed version data, and its source status is Deferred.
  • The unspecified starting version of the range is unknown.
  • The record contains no vendor advisory details on exploitation conditions or the fixed release, so these remain unknown.

Frequently asked questions

What is CVE-2026-32502?

It is an insecure deserialization vulnerability (CWE-502) in the Borgholm marketing agency theme by Select-Themes that allows object injection in versions below 1.6, according to the record.

Is this CVE being actively exploited?

The record does not list it in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. Organizations should still treat the CNA critical score seriously.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.