CVE-2026-27417

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27417", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-19T09:52:28.127Z", "datePublished": "2026-03-05T05:54:00.710Z", "dateUpdated": "2026-04-28T16:15:03.093Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://themeforest.net", "defaultStatus": "unaffected", "packageName": "sweetdate", "product": "Sweet Date", "vendor": "SeventhQueen", "versions": [{"changes": [{"at": "4.0.1", "status": "unaffected"}], "lessThanOrEqual": "4.0.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jo\u00e3o Pedro S Alc\u00e2ntara (Kinorth) | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:05:25.104Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Deserialization of Untrusted Data vulnerability in SeventhQueen Sweet Date sweetdate allows Object Injection.<p>This issue affects Sweet Date: from n/a through < 4.0.1.</p>"}], "value": "Deserialization of Untrusted Data vulnerability in SeventhQueen Sweet Date sweetdate allows Object Injection.This issue affects Sweet Date: from n/a through < 4.0.1."}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "Object Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:15:03.093Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Theme/sweetdate/vulnerability/wordpress-sweet-date-theme-4-0-1-php-object-injection-vulnerability?_s_id=cve"}], "title": "WordPress Sweet Date theme < 4.0.1 - PHP Object Injection vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-06T18:49:17.403010Z", "id": "CVE-2026-27417", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T16:07:34.322Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-27417", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-06T18:49:17.403010Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-06T18:49:10.099Z"}}], "cna": {"title": "WordPress Sweet Date theme < 4.0.1 - PHP Object Injection vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Jo\u00e3o Pedro S Alc\u00e2ntara (Kinorth) | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "Object Injection"}]}], "affected": [{"vendor": "SeventhQueen", "product": "Sweet Date", "versions": [{"status": "affected", "changes": [{"at": "4.0.1", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "< 4.0.1"}], "packageName": "sweetdate", "collectionURL": "https://themeforest.net", "defaultStatus": "unaffected"}], "datePublic": "2026-03-05T06:52:05.962Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Theme/sweetdate/vulnerability/wordpress-sweet-date-theme-4-0-1-php-object-injection-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data vulnerability in SeventhQueen Sweet Date sweetdate allows Object Injection.This issue affects Sweet Date: from n/a through < 4.0.1.", "supportingMedia": [{"type": "text/html", "value": "Deserialization of Untrusted Data vulnerability in SeventhQueen Sweet Date sweetdate allows Object Injection.<p>This issue affects Sweet Date: from n/a through < 4.0.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-05T05:54:00.710Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27417", "state": "PUBLISHED", "dateUpdated": "2026-03-06T18:49:25.357Z", "dateReserved": "2026-02-19T09:52:28.127Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-05T05:54:00.710Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://themeforest.net", "defaultStatus": "unaffected", "packageName": "sweetdate", "product": "Sweet Date", "vendor": "SeventhQueen", "versions": [{"changes": [{"at": "4.0.1", "status": "unaffected"}], "lessThanOrEqual": "4.0.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data vulnerability in SeventhQueen Sweet Date sweetdate allows Object Injection.This issue affects Sweet Date: from n/a through < 4.0.1."}, {"lang": "es", "value": "Vulnerabilidad de deserializaci\u00f3n de datos no confiables en SeventhQueen Sweet Date sweetdate permite la inyecci\u00f3n de objetos. Este problema afecta a Sweet Date: desde n/a hasta &lt; 4.0.1."}], "id": "CVE-2026-27417", "lastModified": "2026-06-17T10:27:08.763", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27417", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-06T18:49:17.403010Z", "version": "2.0.3"}}]}, "published": "2026-03-05T06:16:29.223", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Theme/sweetdate/vulnerability/wordpress-sweet-date-theme-4-0-1-php-object-injection-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.0.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Sweet Date", "source": "cna", "vendor": "SeventhQueen"}, "product": "sweet_date", "vendor": "seventhqueen"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-18T09:55:41.962093+00:00", "value": {"mitigation_remediation": ["Apply the latest Sweet Date theme update (v4.0.1 or newer) to eliminate the deserialization flaw.", "If the theme cannot be updated immediately, temporarily deactivate it or switch to a different theme to prevent exploitation.", "Validate or sanitize any data before it reaches the theme\u2019s deserializer; consider implementing a safe serialization filter or using WordPress provided functions that enforce safe deserialization per CWE\u2011502 guidelines.", "Keep WordPress core, plugins, and other themes up to date, and use firewall rules or monitoring to detect suspicious serialized payloads."], "summary": {"action": "Patch Immediately", "impact": "Remote Code Execution (inferred)"}, "threat_synthesis": {"affected_systems": "Any WordPress installation that uses the SeventhQueen Sweet Date theme with a version earlier than 4.0.1, spanning from the theme\u2019s initial release through the last patched (4.0.1).", "description_and_impact": "The Sweet Date theme for WordPress contains a deserialization of untrusted data flaw that allows attackers to inject arbitrary PHP objects. This vulnerability corresponds to CWE\u2011502 and can lead to remote code execution (inferred from the nature of PHP object injection), enabling attackers to compromise the confidentiality, integrity, and availability of the affected website.", "risk_and_exploitability": "The CVSS score of 9.8 indicates a critical severity, while the EPSS score of < 1% implies a very low current exploitation probability. The likely attack vector is remote (inferred), requiring an attacker to craft a serialized payload and send it via the theme\u2019s web interface or any endpoint that deserializes user input; if the vulnerability is triggered, it is inferred that the attacker could execute arbitrary code on the web server. The issue is not listed in CISA\u2019s KEV catalog, so it has not been confirmed as a known exploited vulnerability yet."}}}}, "created": "2026-03-06T15:12:02.539495+00:00", "updated": "2026-04-18T10:00:10.337032+00:00", "vendors": ["seventhqueen", "seventhqueen$PRODUCT$sweet_date", "wordpress", "wordpress$PRODUCT$wordpress"]}