BoldThemes Avala: PHP Object Injection in WordPress theme

Summary

The Avala WordPress theme by BoldThemes up to and including version 1.1.4 is vulnerable to PHP Object Injection (CWE-502) through unsafe deserialization of untrusted data. An unauthenticated remote attacker can exploit this over the network with low complexity. Successful exploitation could allow manipulation of server-side data processing and, depending on the gadget chains present in the installed code, may lead to a full compromise of the website server. Patchstack rates the flaw as high priority with a CVSS score of 9.8.

Affected

• BoldThemes Avala WordPress theme, versions up to and including 1.1.4
• Default configuration: unaffected (per CNA record, affected range applies to the listed versions)

Fixed in

• Unknown. No BoldThemes security advisory or confirmed fixed version was found.
• Unverified third-party enrichment suggests version 1.1.5 or later; not confirmed by the vendor.

Workaround

• No vendor-published workaround known.
• Patchstack reports a mitigation rule to block attacks until an official patch is available (requires a Patchstack subscription).
• A web application firewall or virtual patch from a reputable provider may reduce exposure; verify the rule before relying on it.

Exploitation

• Not listed in CISA KEV; no known active exploitation at the time of research.
• CISA SSVC (Vulnrichment): exploitation none, automatable yes, technical impact total.
• EPSS about 0.004 (low).
• No public proof of concept found in searches; this does not prove none exists.

Our recommendation

• Check whether any WordPress site uses the Avala theme and identify its version.
• If the site runs version 1.1.4 or earlier, apply a verified fixed version from the official vendor only; do not use nulled or pirated copies.
• If no verified fix is available, replace the theme or take the site offline, and consider a reputable WAF or virtual patch in the meantime.
• Monitor web server logs for suspicious serialized payloads and keep WordPress core and other components up to date.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack advisory for Avala theme patchstack.com
• OpenCVE CVE-2026-62077 app.opencve.io
• Vulners Rapid7 CVE-2026-62077 vulners.com
• HOL Guard CVE-2026-62077 hol.org
• Avala on ThemeForest themeforest.net
• Strix CVE-2026-62077 www.strix.ai

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:34.