Unauthenticated PHP Object Injection in Adrena Theme by Adrena
CVE-2026-65576

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Adrena
Vendor
CVE Published:
6 August 2026

What is CVE-2026-65576?

The Adrena Theme, a popular choice for WordPress users, has a vulnerability that allows unauthenticated PHP Object Injection in versions up to 1.2.14. This flaw can be exploited by attackers to manipulate the internal objects of the application, potentially leading to unauthorized actions or data exposure. It is crucial for users of this theme to update to the latest version to mitigate the associated risks.

Affected Version(s)

Adrena <= 1.2.14

References

https://patchstack.com/database/wordpress/theme/adrena/vu...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bonds | Patchstack Bug Bounty Program
.