Security readout for executives and security teams
Plain-English summary
FreightCo WordPress theme versions through 1.1.15 are reported vulnerable to unauthenticated PHP object injection. A remote attacker may reach the flaw without credentials or user interaction, potentially causing severe data theft, unauthorized changes, or service disruption. The supplied sources do not identify a confirmed fix.
Executive priority
Treat this as an immediate investigation and remediation priority for any organization using FreightCo. The reported flaw requires no credentials and carries maximum business-impact categories. First establish whether the theme is deployed, then contain confirmed exposure and follow vendor-supported remediation. Escalate suspected compromise to incident response.
Technical view
CVE-2026-66650 is classified as CWE-502 with CVSS 3.1 score 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). This indicates network-reachable, low-complexity exploitation without authentication or user interaction, with high confidentiality, integrity, and availability impact. The source bundle does not disclose the affected endpoint, object chain prerequisites, or exploitation mechanics.
Likely exposure
Potentially exposed organizations are those operating WordPress sites with FreightCo version 1.1.15 or earlier, particularly internet-accessible deployments. Confirm actual exposure through theme inventories and deployment records. The structured affected-product metadata lists versions as “n/a” and defaults to unaffected, conflicting with the title and description; therefore, validate against current vendor guidance.
Exploitation context
The bundle reports unauthenticated remote reachability and critical impact, but provides no evidence of active exploitation. The CVE is not listed as KEV in the supplied data. Absence from KEV does not establish that exploitation is impossible or has not occurred elsewhere.
Researcher notes
The available evidence establishes CWE-502, the affected-version claim, and the CVSS vector, but not the vulnerable code path, serialized input source, required gadget chain, fixed release, or indicators of compromise. The affected-product metadata conflict should be resolved using authoritative vendor guidance before declaring individual installations vulnerable or remediated.
Mitigation direction
- Inventory all WordPress deployments for FreightCo and record installed versions.
- Check Theme-Rex and Patchstack guidance for a supported fixed version or official mitigation.
- Prioritize isolating or restricting access to confirmed vulnerable sites until remediation is available.
- Preserve current backups and security logs before making operational changes.
Validation and detection
- Verify FreightCo versions directly from each deployed WordPress instance and trusted asset records.
- Confirm remediation status against current Theme-Rex or Patchstack guidance.
- Review web, application, and authentication logs for unusual unauthenticated activity or unexplained changes.
- After remediation, confirm affected versions are absent and critical site functions remain operational.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-502: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-66650 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9PatchstackVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://patchstack.com/database/wordpress/theme/freightco/vulnerability/wordpress-freightco-theme-1-1-15-php-object-injection-vulnerability?_s_id=cveCVE reference, Patchstack · vdb-entry
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Deserialization of Untrusted Data
Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.