CVE-2026-27338: WordPress Car Zone theme <= 3.7 - Deserialization of untrusted data vulnerability
Published Mar 5, 2026
·Updated
Deserialization of Untrusted Data vulnerability in AivahThemes Car Zone carzone allows Object Injection.This issue affects Car Zone: from n/a through <= 3.7.
Affected Software
2 affected components
Aivahthemes Car Zone<=3.7
wordpress/car-zone<=3.7
Event History
Mar 5, 2026
CVE Published
via MITRE·05:53 AM
Data Sourced
via MITRE·05:53 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·06:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-27338?
CVE-2026-27338 is classified as a critical vulnerability due to the potential for remote code execution.
2
How do I fix CVE-2026-27338?
To fix CVE-2026-27338, update the Car Zone theme to version 3.8 or later.
3
What types of attacks can CVE-2026-27338 enable?
CVE-2026-27338 can enable object injection attacks, potentially leading to unauthorized access or data manipulation.
4
Who is affected by CVE-2026-27338?
CVE-2026-27338 affects users running AivahThemes Car Zone theme version 3.7 or earlier on their WordPress sites.
5
Is there a workaround for CVE-2026-27338 if I cannot update immediately?
A temporary workaround for CVE-2026-27338 involves disabling the features vulnerable to object injection until an update can be applied.