CVE-2026-22497
Deserialization Object Injection in AncoraThemes Jardi
Publication date: 2026-03-05
Last updated on: 2026-03-09
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ancorathemes | jardi | From 1.0.0 (inc) to 1.7.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22497 is a high-severity PHP Object Injection vulnerability found in the WordPress Jardi Theme versions up to and including 1.7.2.
This vulnerability allows unauthenticated attackers to perform PHP Object Injection by exploiting deserialization of untrusted data, which can lead to severe security issues.
It is classified under the OWASP Top 10 category A3: Injection.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to remote code execution, SQL injection, path traversal, denial of service, and other severe impacts if a suitable Property Oriented Programming (POP) chain is available.
The vulnerability requires no privileges to exploit, making it particularly dangerous for WordPress sites using the vulnerable Jardi Theme versions.
Because of its critical risk and high likelihood of exploitation, it can severely compromise the security and integrity of affected websites.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided about detection commands or methods for this vulnerability.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the mitigation rule developed and issued by Patchstack to block attacks targeting this vulnerability.
Since no official patch is available as of the publication date, deploying this mitigation rule can automatically protect affected websites using the vulnerable Jardi Theme versions up to 1.7.2.
It is also recommended to prioritize this vulnerability as high risk and take immediate action to prevent exploitation.