Unauthenticated PHP Object Injection in ShiftCV Theme by PatchStack

CVE-2026-66564

What is CVE-2026-66564?

The ShiftCV Theme versions up to 3.0.14 are vulnerable to an unauthenticated PHP Object Injection attack. This security flaw allows attackers to exploit the theme by injecting malicious PHP objects without needing authentication. Such vulnerabilities can be exploited to gain unauthorized access, execute arbitrary code, or manipulate the application's behavior, posing significant risks to the integrity and security of WordPress sites utilizing this theme. It is crucial for administrators to update to the latest version to mitigate potential threats associated with this vulnerability.

References