CVE-2026-27098

HighRCE

Published: 05 March 2026

Published

05 March 2026

Modified

22 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0031 22.3th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-27098 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-27098 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Au Pair Agency - Babysitting & Nanny Theme (au-pair-agency) for WordPress, developed by axiomthemes. The flaw enables Object Injection and affects all versions from n/a through 1.2.2. Published on 2026-03-05, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impacts across confidentiality, integrity, and availability.

Unauthenticated remote attackers can exploit this vulnerability over the network without requiring user interaction, though exploitation demands high attack complexity. Successful attacks could compromise the confidentiality, integrity, and availability of the affected WordPress site to a high degree, leveraging the object injection to manipulate deserialized data in ways that align with the vulnerability's characteristics.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/au-pair-agency/vulnerability/wordpress-au-pair-agency-babysitting-nanny-theme-theme-1-2-2-deserialization-of-untrusted-data-vulnerability?_s_id=cve.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-9604

Vulnerability details

Deserialization of Untrusted Data vulnerability in axiomthemes Au Pair Agency - Babysitting & Nanny Theme au-pair-agency allows Object Injection.This issue affects Au Pair Agency - Babysitting & Nanny Theme: from n/a through <= 1.2.2.

CWE(s): CWE-502

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Remote unauthenticated deserialization/object injection flaw in public-facing WordPress theme directly enables T1190 (Exploit Public-Facing Application) for initial access with high CIA impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0