First day on Intigriti: our agent harness found and proved a remote code execution bug, paid €3,000.

CVE-2026-65575

CriticalCVSS 9.8/10Last modified Oct 24, 2026

Description

Unauthenticated PHP Object Injection in Accalia <= 1.5.3 versions.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
AncoraThemes	Accalia	<= 1.5.3

References

https://patchstack.com/database/wordpress/theme/accalia/vulnerability/wordpress-accalia-theme-1-5-3-php-object-injection-vulnerability?_s_id=cve

Timeline

Published: Aug 6, 2026
Last modified: Oct 24, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-655769.8Unauthenticated PHP Object Injection in Adrena <= 1.2.14 versions.CVE-2026-655779.8Unauthenticated PHP Object Injection in Advice <= 1.18.0 versions.CVE-2026-655789.8Unauthenticated PHP Object Injection in Agora <= 1.9 versions.CVE-2026-655799.8Unauthenticated PHP Object Injection in Agricola <= 1.21.0 versions.CVE-2026-655807.1Unauthenticated Cross Site Scripting (XSS) in Agrion <= 1.0.0 versions.CVE-2026-655819.8Unauthenticated PHP Object Injection in AI ANN <= 1.29.0 versions.CVE-2026-655827.7Subscriber Arbitrary File Download in AI Hub <= 1.3.10 versions.CVE-2026-655839.1Apache CXF’s OIDC relying-party token validation could accept self-issued ID tokens without enforcing required claim checks (issuer/subject/CVE-2026-655896.5n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys CVE-2026-65594.3A weakness has been identified in Wavlink WL-WN579A3 220323. This affects the function sub_401F80 of the file /cgi-bin/login.cgi. This manip CVE-2026-655909.8n8n before 2.29.8 and 2.30.x before 2.30.1 does not enforce shell sandbox restrictions on Linux and Windows in the @n8n/computer-use package CVE-2026-655918.8n8n contains a sanitizer bypass vulnerability in the legacy expression evaluator's computed-member handler. An authenticated user with workf