First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-40739

HighCVSS 8.1/10Last modified Oct 26, 2026

Description

Unauthenticated PHP Object Injection in LuxeDrive <= 1.4 versions.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
Mikado-Themes	LuxeDrive	<= 1.4

References

https://patchstack.com/database/wordpress/theme/luxedrive/vulnerability/wordpress-luxedrive-theme-1-4-php-object-injection-vulnerability?_s_id=cve

Timeline

Published: Jun 17, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-40746.4The Quran Live Multilanguage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cheikh' and 'lang' shortcode attribu CVE-2026-407405.4Missing Authorization vulnerability in Themeum Tutor LMS tutor allows Exploiting Incorrectly Configured Access Control Security Levels.This CVE-2026-407417.5Unauthenticated Broken Access Control in Redsys for WooCommerce Light <= 7.0.0 versions.CVE-2026-407425.3Missing Authorization vulnerability in Nelio Software Nelio AB Testing nelio-ab-testing allows Exploiting Incorrectly Configured Access Cont CVE-2026-407436.5Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.CVE-2026-407448.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beaver Builder Beaver Builder beaver-b CVE-2026-407457.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bdthemes Element Pack Elementor Addons CVE-2026-407469.9Subscriber Arbitrary File Upload in Restaurant Zone <= 0.7.8 versions.CVE-2026-407479.9Subscriber Arbitrary File Upload in Ecommerce Zone <= 0.9.7 versions.CVE-2026-407489.9Subscriber Arbitrary File Upload in Kids Gift Shop <= 0.5.4 versions.CVE-2026-407499.9Subscriber Arbitrary File Upload in Charity Zone <= 1.1.1 versions.CVE-2026-40756.4The BWL Advanced FAQ Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'baf_sbox' shortcode in all vers

CVE-2026-40739: High severity, CVSS 8.1 | Vulnix