CVE Intelligence
Analysis AI-assisted

CVE-2026-62077: BoldThemes Avala WordPress Theme - PHP Object Injection

An unauthenticated PHP Object Injection vulnerability (CWE-502) affects the BoldThemes Avala WordPress theme up to and including 1.1.4. The record assigns a CVSS 3.1 base score of 9.8, and no fixed version is listed. No confirmed exploitation appears in the sources consulted, and the CVE is not in the CISA KEV catalog.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

A PHP Object Injection vulnerability (CWE-502, Deserialization of Untrusted Data) has been reported in the Avala theme for WordPress from BoldThemes, in versions up to and including 1.1.4. According to the record, it can be triggered without authentication. Source: Patchstack entry.

Impact

The record gives a CVSS 3.1 base score of 9.8 (critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This describes network-reachable exploitation with low complexity, no privileges and no user interaction, and high impact on confidentiality, integrity and availability. The concrete consequences depend on code available in the installed site, which the record does not describe.

Affected products and versions

  • Product: BoldThemes Avala (WordPress theme)
  • Affected range: up to and including 1.1.4
  • Fixed version: none listed in the record

Exploitation status

The CVE is not listed in the CISA KEV catalog. The SSVC exploitation field is "none", and the EPSS probability is 0.00386 (percentile 0.31529, dated 2026-10-23). No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Check the vendor for a release newer than 1.1.4, since the record does not identify a fixed version.
  • If the theme is not needed, deactivate and remove it.
  • Limit exposure of affected sites until a fix is verified. A web application firewall rule may reduce risk but does not replace patching.

Detection guidance

  • Review web server and application logs for unusual requests to theme-related endpoints and for unexpected serialized data in parameters, cookies or headers.
  • Watch for unexpected file changes or newly created administrative accounts on affected sites.

Limitations of the available information

The record contains no fixed version, no vendor advisory text, no detailed description of the vulnerable input, and no public technical details. The CVSS source field holds an email address rather than a scoring organization. The record's source status is Deferred.

Frequently asked questions

Does this affect my site?

It applies if you run BoldThemes Avala in version 1.1.4 or earlier. Confirm the installed theme version before deciding on actions.

Is a fix available?

The record lists no fixed version. Check the vendor for a newer release and treat affected sites as at risk until a fix is verified.

Is it being exploited?

The CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.