External risk intelligence

Agora Theme PHP Object Injection

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-65578

The vulnerability affects a WordPress theme, which is by definition a web-facing component of a content management system. As a public-facing web application component, it is commonly deployed in environments reachable from the internet.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in the Agora WordPress theme, specifically a PHP Object Injection flaw. The issue allows unauthenticated attackers to potentially inject malicious code into systems using affected versions of the theme. The main concern is to confirm if this specific theme and version are in use within your environment.

Unauthenticated code injection in a WordPress theme.
External attacks could compromise websites.
Confirm exposure and relevance for this theme.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending specially crafted requests to a web server running the Agora theme. Since no authentication is required, the attacker can target any publicly accessible instance of the theme. This allows them to trigger a PHP Object Injection flaw within the theme's code. When triggered, this could lead to serious security consequences for the affected website.

No authentication needed.
Triggered by crafted web requests.
Allows remote code execution.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an unauthenticated PHP Object Injection vulnerability in the Agora theme could allow an attacker to inject malicious code, potentially leading to the execution of arbitrary code on the server and compromise of its integrity.

Server-side code execution.
Unauthenticated remote injection.
Full server compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

PHP Object Injection in the Agora theme presents a critical, unauthenticated risk, potentially allowing attackers to compromise affected WordPress sites. Ownership will likely fall to the application or platform team responsible for managing WordPress instances and their plugins/themes. The immediate priority is to identify all deployments of the Agora theme, assess their exposure and business criticality, and then coordinate with the vendor or internal teams to plan remediation based on the assessed risk.

Application owners should address the issue.
Verify theme installations and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Agora WordPress theme?

Agora is a software theme designed for the WordPress content management system. It is used to define the visual layout and user interface of a website. Because it functions as part of the web-serving infrastructure, it manages how content is rendered and interacts with server-side processes whenever a visitor accesses the site.

What does PHP Object Injection mean for CVE-2026-65578?

This vulnerability falls under the Improper Deserialization weakness class (CWE-502). It occurs when the theme processes untrusted data without sufficient validation, allowing an attacker to insert malicious PHP objects into the application's memory. By doing so, they can manipulate the code's execution flow, potentially leading to unauthorized actions or full server compromise.

How is this vulnerability triggered?

An attacker triggers this flaw by sending a specially crafted web request to a server running an affected version of the Agora theme. Because the vulnerability is unauthenticated, no user account or login session is required to initiate the attack. Simply viewing a page normally or performing standard site navigation does not trigger the bug; it requires specific, malicious input designed to exploit the deserialization process.

Is my website at risk from this CVE?

If you are running the Agora theme version 1.9 or older, your site is likely at risk. According to Halo Surface Signal, this vulnerability affects a web-facing component that is by definition reachable from the internet. Because WordPress themes serve as the public interface for your content, any instance exposed to the internet is a potential target for remote attackers.

How should I respond to this threat?

Your first step is to audit your WordPress environments to identify if the Agora theme is installed and active. If found, prioritize determining the version in use. Consult with your web administration or development teams to plan for an update or temporary removal of the theme until a secure version is available, ensuring you mitigate the risk of unauthorized code execution.

References

patchstack.com/database/wordpress/theme/agora/vulnerability/wordpres…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.