CVE-2026-42723: CleanSkin WordPress Theme PHP Object Injection
CVE-2026-42723 is a critical PHP Object Injection flaw (CWE-502) in the CleanSkin WordPress theme by AncoraThemes, affecting versions up to and including 1.5.0. The record describes it as unauthenticated and lists a CVSS 3.1 base score of 9.8 from Patchstack. The sources consulted show no fixed version and no confirmed exploitation.
Overview
CVE-2026-42723 affects the CleanSkin WordPress theme from AncoraThemes. The record classifies it as PHP Object Injection under CWE-502, Deserialization of Untrusted Data. The vulnerability is listed as affecting versions up to and including 1.5.0. The CNA is Patchstack, which published the entry in its vulnerability database.
Impact
- The CVSS 3.1 vector in the record is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network reachability, low complexity, no privileges and no user interaction required, with high impact to confidentiality, integrity and availability.
- The SSVC data in the record rates technical impact as total and marks the issue as automatable.
- Deserialization flaws of this class generally allow untrusted input to influence application objects, which can lead to data exposure, modification or code paths that the site owner did not intend. The exact consequences in this theme are not described in the record.
Affected products and versions
- Product: AncoraThemes CleanSkin (WordPress theme).
- Affected versions: up to and including 1.5.0.
- No fixed version is listed in the record. This does not mean no fix exists; the absence of data is unknown, so check the vendor and the Patchstack entry for current status.
Exploitation status
The CISA KEV catalog does not list this CVE in the record. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00386 (percentile 0.30828) as of 2026-10-13, and the SSVC exploitation field is recorded as none. These values describe modelled likelihood and current status, not confirmed attacks.
Remediation and mitigation
- Identify every WordPress site that uses CleanSkin and confirm the installed version.
- Check the Patchstack entry and the vendor for an updated release. If a version newer than 1.5.0 is published, plan to update after testing.
- If no fixed version is available and the theme is not essential, consider replacing or deactivating it.
- Limit exposure of administrative and unnecessary endpoints while remediation is pending, and keep WordPress core and other plugins up to date.
Detection guidance
- Review web server and application logs for unusual requests directed at the theme, especially repeated or malformed inputs that reach theme code.
- Monitor for unexpected changes to site files, database content or administrative accounts.
- Track alerts from your web application firewall or security monitoring tools, recognizing that signature coverage for this specific flaw is unknown.
Limitations of the available information
The record does not provide the vulnerable function, the exact input path, a fixed version, vendor advisory text or proof-of-concept details. The CVSS data comes from Patchstack and the record also shows a second entry under the same score. Exploitation status is limited to the KEV and EPSS data in the record and may change.
Frequently asked questions
What is CVE-2026-42723?
It is a critical PHP Object Injection vulnerability (CWE-502) in the CleanSkin WordPress theme by AncoraThemes, affecting versions up to and including 1.5.0, according to the record.
Is this vulnerability being actively exploited?
The CVE is not listed in the CISA KEV catalog in the record, and no confirmed exploitation appears in the sources consulted. The EPSS data is recorded for 2026-10-13.
Which version fixes the issue?
The record does not list a fixed version. Check the Patchstack entry and the vendor for current information before deciding on an update or replacement.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.