Unauthenticated PHP Object Injection in Valiance Theme by Patchstack
CVE-2026-39578

8.1HIGH

Key Information:

Vendor

WordPress
Status
Valiance
Vendor
CVE Published:
16 June 2026

What is CVE-2026-39578?

The vulnerability in the Valiance Theme exposes systems to risks through unauthenticated PHP Object Injection, potentially leading to harmful code execution. Attackers can exploit this weak point in versions 1.2 and earlier, enabling them to manipulate the application's execution flow and gain unauthorized access to sensitive operations. It is crucial for users of the Valiance Theme to implement corrective measures to secure their applications from potential exploitation.

Affected Version(s)

Valiance <= 1.2

References

https://patchstack.com/database/wordpress/theme/valiance/...
vdb-entry

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Denver Jackson | Patchstack Bug Bounty Program
.