CVE-2026-32512

CriticalRCE

Published: 25 March 2026

Published

25 March 2026

Modified

24 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0037 29.2th percentile

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-32512 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-32512 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Pelicula WordPress theme by Edge-Themes, a video production and movie theme. The flaw enables Object Injection and affects all versions of Pelicula from n/a through those prior to 1.10.

With a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the vulnerability allows unauthenticated remote attackers to exploit it over the network with low complexity and no user interaction. Successful exploitation can result in high impacts to confidentiality, integrity, and availability through object injection.

The Patchstack advisory details the PHP object injection vulnerability in the Pelicula theme and indicates it is resolved in version 1.10. Mitigation involves updating affected WordPress installations to Pelicula version 1.10 or later.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-15868

Vulnerability details

Deserialization of Untrusted Data vulnerability in Edge-Themes Pelicula pelicula-video-production-and-movie-theme allows Object Injection.This issue affects Pelicula: from n/a through < 1.10.

CWE(s): CWE-502

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Unauthenticated remote PHP deserialization/object injection flaw in public-facing WordPress theme directly matches T1190 Exploit Public-Facing Application as the initial access vector, enabling RCE with full CIA impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0