CVE Intelligence
Analysis AI-assisted

CVE-2026-32512: Edge-Themes Pelicula WordPress Theme: PHP Object Injection

CVE-2026-32512 describes a deserialization of untrusted data weakness (CWE-502) in the Pelicula theme by Edge-Themes, classified as object injection. The record states that versions below 1.10 are affected, and the CNA Patchstack assigned a CVSS 3.1 base score of 9.8 (critical). No confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-32512 is a deserialization of untrusted data weakness (CWE-502) in the Pelicula video production and movie theme for WordPress, published by Edge-Themes. The record classifies it as object injection. Details are limited to the CNA description and the Patchstack entry linked below.

Impact

  • The record describes object injection arising from unsafe handling of serialized data.
  • The CNA scored the issue 9.8 under CVSS 3.1, with a network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability.
  • The real-world consequences depend on code paths that the available sources do not describe.

Affected products and versions

  • Product: Pelicula (Edge-Themes), a WordPress theme.
  • Affected range: versions below 1.10. The record does not state a lower bound.
  • The record lists no fixed version. Based on the upper bound, 1.10 appears to be the first unaffected release, but this should be confirmed with the vendor or the Patchstack entry.

Exploitation status

  • The CISA KEV catalog does not list this CVE according to the record.
  • No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Identify every site running the Pelicula theme and record the installed version.
  • Update to version 1.10 or later, after confirming the update source against the vendor or the Patchstack entry.
  • If an update cannot be applied immediately, limit access to the administrative area, restrict who can upload or modify theme content, and consider a web application firewall as a temporary control.
  • Confirm that recent, offline backups are available for recovery.

Detection guidance

  • Inventory the theme and its version across all WordPress installations.
  • Review web server and application logs for unusual requests to theme components that carry serialized data.
  • Watch for unexpected file changes or newly created administrative accounts.

Limitations of the available information

  • The record contains no full vendor advisory, no lower bound for affected versions, and no explicit fixed version.
  • Exploit prerequisites and the affected code paths are not described.
  • EPSS values are statistical estimates and do not confirm exploitation.
  • The information comes from the CNA record and the linked Patchstack entry. The NVD and CVE.org pages are listed as sources but no additional content was provided in the record.

Frequently asked questions

What is CVE-2026-32512?

It is a deserialization of untrusted data weakness (CWE-502) in the Pelicula WordPress theme by Edge-Themes, classified in the record as object injection.

Which versions are affected?

The record says versions below 1.10 are affected but does not state a lower bound. Version 1.10 is the apparent first unaffected release, which should be confirmed with the vendor.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.