{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27096", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-17T13:24:05.456Z", "datePublished": "2026-03-19T05:31:42.330Z", "dateUpdated": "2026-04-28T16:15:01.674Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "ColorFolio - Freelance Designer WordPress Theme", "vendor": "BuddhaThemes", "versions": [{"lessThanOrEqual": "1.3", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.<p>This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3.</p>"}], "value": "Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3."}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "CAPEC-586 Object Injection"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:15:01.674Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/theme/colorfolio/vulnerability/wordpress-colorfolio-freelance-designer-wordpress-theme-theme-1-3-deserialization-of-untrusted-data-vulnerability?_s_id=cve"}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress ColorFolio - Freelance Designer WordPress Theme theme <= 1.3 - Deserialization of untrusted data vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-19T14:07:24.624973Z", "id": "CVE-2026-27096", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T14:08:03.842Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27096", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-19T14:07:24.624973Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T14:07:56.034Z"}}], "cna": {"title": "WordPress ColorFolio - Freelance Designer WordPress Theme theme <= 1.3 - Deserialization of untrusted data vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "CAPEC-586 Object Injection"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "BuddhaThemes", "product": "ColorFolio - Freelance Designer WordPress Theme", "versions": [{"status": "affected", "version": "n/a", "versionType": "custom", "lessThanOrEqual": "1.3"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://patchstack.com/database/wordpress/theme/colorfolio/vulnerability/wordpress-colorfolio-freelance-designer-wordpress-theme-theme-1-3-deserialization-of-untrusted-data-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3.", "supportingMedia": [{"type": "text/html", "value": "Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.<p>This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-19T05:31:42.330Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27096", "state": "PUBLISHED", "dateUpdated": "2026-03-19T14:08:03.842Z", "dateReserved": "2026-02-17T13:24:05.456Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-19T05:31:42.330Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3."}, {"lang": "es", "value": "Vulnerabilidad de deserializaci\u00f3n de datos no confiables en el tema de WordPress BuddhaThemes ColorFolio - Dise\u00f1ador Freelance permite la inyecci\u00f3n de objetos. Este problema afecta al tema de WordPress ColorFolio - Dise\u00f1ador Freelance: desde n/a hasta 1.3."}], "id": "CVE-2026-27096", "lastModified": "2026-04-28T19:37:14.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2026-03-19T06:16:25.190", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/theme/colorfolio/vulnerability/wordpress-colorfolio-freelance-designer-wordpress-theme-theme-1-3-deserialization-of-untrusted-data-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.3]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "ColorFolio - Freelance Designer WordPress Theme", "source": "cna", "vendor": "BuddhaThemes"}, "product": "colorfolio_-_freelance_designer_wordpress_theme", "vendor": "buddhathemes"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-29T00:49:03.823826+00:00", "value": {"mitigation_remediation": ["Update ColorFolio to any version newer than 1.3 (official vendor patch).", "If an update cannot be performed immediately, disable or deactivate the theme so its code is not executed.", "As an interim measure, restrict or block inputs that trigger the deserialization routine, such as disabling theme widgets or shortcodes that accept user data."], "summary": {"action": "Patch Now", "impact": "Object Injection"}, "threat_synthesis": {"affected_systems": "The affected product is BuddhaThemes ColorFolio \u2013 Freelance Designer WordPress Theme. All releases from the earliest available version through 1.3 inclusive are vulnerable. No additional sub\u2011products or variants are listed.", "description_and_impact": "The ColorFolio theme contains a flaw that deserializes untrusted data, allowing an attacker to inject serialized objects. This opens the possibility for arbitrary code execution if the attacker can supply a crafted payload, which could compromise the WordPress site\u2019s confidentiality, integrity, and availability. The impact is limited to installations that use the vulnerable theme, but the consequences could affect the entire site.", "risk_and_exploitability": "The CVSS score of 8.1 indicates a high severity. EPSS data shows a very low exploitation probability (less than 1%), suggesting that the vulnerability is not currently widely exploited. The theme is delivered via WordPress, so a remote attack vector is likely, inferred from the public nature of WordPress sites and potential deserialization points such as widgets or shortcodes. The vulnerability is not listed in the CISA KEV catalog. Overall, the risk remains high due to the severity score and the potential for critical compromise if the flaw is effectively exploited."}}}}, "created": "2026-03-19T08:54:34.128055+00:00", "updated": "2026-04-29T01:00:11.349671+00:00", "vendors": ["buddhathemes", "buddhathemes$PRODUCT$colorfolio_-_freelance_designer_wordpress_theme", "wordpress", "wordpress$PRODUCT$wordpress"]}