CVE-2026-32512: 
WordPress vulnerability analysis and mitigation

CVE-2026-32512 is a PHP Object Injection vulnerability (Deserialization of Untrusted Data) in the Edge-Themes Pelicula WordPress theme, affecting all versions prior to 1.10. It was reported by researcher Denver Jackson on January 21, 2026, disclosed by Patchstack on March 20, 2026, and published to NVD on March 25, 2026. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), requiring no authentication or user interaction (Patchstack).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data), enabling PHP Object Injection (CAPEC-586). The flaw exists in the Pelicula theme's handling of serialized PHP data, where attacker-controlled input is passed to an unserialization function without adequate validation. If a suitable Property-Oriented Programming (POP) chain exists within the WordPress installation or its plugins, an unauthenticated remote attacker can instantiate arbitrary PHP objects, potentially leading to code execution, SQL injection, path traversal, or denial of service (Patchstack).

Successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected WordPress site. Depending on available POP chains in the environment, an unauthenticated attacker could achieve remote code execution, exfiltrate sensitive data, manipulate the database via SQL injection, traverse the file system, or render the site unavailable. The network-accessible attack vector with no authentication requirement makes this vulnerability particularly dangerous for mass exploitation campaigns targeting WordPress sites at scale (Patchstack).

There is currently no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.024% (0.000240), indicating a low current probability of exploitation. No threat actor attribution has been made, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack rates it as high priority and notes that vulnerabilities of this class are frequently used in mass-exploit campaigns against WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites using the Pelicula theme (versions < 1.10) via passive fingerprinting tools (e.g., WPScan, Shodan) by detecting theme-specific assets or metadata in HTTP responses.
2. Identify injection point: Locate the vulnerable endpoint or parameter in the Pelicula theme that accepts and deserializes user-supplied data without sanitization.
3. Enumerate POP chains: Analyze the target WordPress installation and its installed plugins/themes for usable PHP classes with magic methods (__wakeup, __destruct, __toString) that can be chained to achieve a desired effect (e.g., file write, command execution).
4. Craft malicious payload: Serialize a PHP object that triggers the identified POP chain upon deserialization, embedding the desired malicious action (e.g., writing a web shell, executing a system command).
5. Submit payload: Send an unauthenticated HTTP request to the vulnerable endpoint with the crafted serialized payload.
6. Achieve objective: Upon deserialization server-side, the POP chain executes, potentially granting remote code execution, file system access, or other impacts depending on available gadgets (Patchstack).

• Network: Unusual or malformed HTTP requests to Pelicula theme endpoints containing serialized PHP data (e.g., strings beginning with O:, a:, or s: in request parameters or cookies); unexpected outbound connections from the web server process.
• Logs: Web server access logs showing repeated unauthenticated POST requests to theme-specific endpoints with large or encoded payloads; PHP error logs referencing unserialization failures or unexpected class instantiation.
• File System: Newly created or modified PHP files in the WordPress theme or uploads directory (potential web shells); unexpected changes to wp-config.php or core WordPress files.
• Process: Unusual child processes spawned by the web server (e.g., php, bash, curl, wget) executing system commands not typical of normal WordPress operation.

The primary remediation is to update the Pelicula WordPress theme to version 1.10 or later, which contains the fix for this vulnerability. If immediate patching is not possible, Patchstack has issued a virtual patching/mitigation rule for subscribers to block exploitation attempts until the update can be applied. Additionally, administrators should implement input validation for all deserialized data, restrict access to vulnerable endpoints where feasible, and monitor for suspicious PHP serialization activity (Patchstack).

Patchstack, which coordinated the disclosure, classifies this as a high-priority vulnerability and warns that PHP Object Injection flaws of this severity are commonly leveraged in mass-exploit campaigns targeting WordPress sites. The vulnerability was also noted in the Wordfence Intelligence Weekly WordPress Vulnerability Report for the week of March 16–22, 2026, indicating broader community awareness within the WordPress security ecosystem (Patchstack, Wordfence).