PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39545 Select-Themes CVE debrief

CVE-2026-39545 is a high-severity vulnerability in the Zermatt theme, affecting versions up to 1.6.1. The vulnerability allows for unauthenticated PHP object injection, which can lead to significant impacts including high confidentiality, integrity, and availability risks. The CVSS score for this vulnerability is 8.1, indicating a high level of severity. Users of the Zermatt theme should take immediate action to mitigate this risk. The vulnerability was published on June 17, 2026, and has been tracked by various sources including the National Vulnerability Database (NVD).

Vendor
Select-Themes
Product
Zermatt
CVSS
HIGH 8.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-17
Advisory published
2026-06-17
Advisory updated
2026-06-17

Who should care

Administrators and users of the Zermatt theme version 1.6.1 or lower should be concerned about this vulnerability. Given its high severity and potential for significant impact, immediate attention is required to secure affected installations.

Technical summary

CVE-2026-39545 is a PHP object injection vulnerability in the Zermatt theme for WordPress, affecting versions up to 1.6.1. This vulnerability is rated with a CVSS score of 8.1, indicating high severity. The vulnerability allows unauthenticated attackers to inject PHP objects, potentially leading to code execution, data breaches, and other malicious activities. The Common Weakness Enumeration (CWE) associated with this vulnerability is CWE-502, which relates to the deserialization of untrusted data.

Defensive priority

High

Recommended defensive actions

  • Update the Zermatt theme to a version that is not vulnerable (if available).
  • Restrict access to the Zermatt theme's files and directories to prevent unauthorized access.
  • Implement a Web Application Firewall (WAF) to detect and block suspicious traffic.
  • Regularly monitor the Zermatt theme's logs for signs of exploitation.
  • Consider using a security plugin or service to detect and mitigate vulnerabilities.
  • Limit the use of PHP object serialization and deserialization in the Zermatt theme.
  • Review the Zermatt theme's code for any suspicious or vulnerable patterns.

Evidence notes

The information provided is based on data from the National Vulnerability Database (NVD) and Patchstack. The CVE record and NVD detail pages provide official information about the vulnerability, while Patchstack offers additional context and potential mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-39545 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-39545

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-39545 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-39545

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.