PT-2026-27831 · WordPress · Ancorathemes Melody

Published 2026-03-25 · Updated 2026-03-30 · CVE-2026-22510

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AncoraThemes Melody versions n/a through 1.6.3

Description A flaw exists in the deserialization of untrusted data within AncoraThemes Melody melodyschool, potentially allowing for object injection. This issue could allow an attacker to inject malicious objects into the system.

Recommendations Update AncoraThemes Melody to a version later than 1.6.3.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-22510

Affected Products

Ancorathemes Melody

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-22510 · Security Note
• https://twitter.com/CVEnew/status/2038618122333090287 · Twitter Post
• https://patchstack.com/database/Wordpress/Theme/melodyschool/vulnerability/wordpress-melody-theme-1-6-3-php-object-injection-vulnerability?_s_id=cve · Note