home / blog
2026-10-30 · critical
CVE-2026-61998: Unauthenticated Object Injection in Le Truffe
Unauthenticated PHP Object Injection in Le Truffe theme <= 1.1.7. CVSS 9.8 critical. No patch yet.
CVE-2026-61998 is an unauthenticated PHP Object Injection vulnerability discovered in the WordPress Le Truffe theme up to version 1.1.7. Any WordPress site using this theme in a vulnerable version is exposed: an attacker does not need credentials to exploit the flaw and could inject malicious serialized PHP objects, leading to remote code execution or sensitive data disclosure.
The CVSS score is 9.8, classified as critical. The vulnerability was published on NVD on 2026-10-29 and currently no official patch is available, as confirmed by signals in the last 24 hours. Visibility is still low (1 post on X with 3 interactions), but given the severity and lack of fix, every administrator should consider this an immediate threat.
Defenders must act immediately: identify which WordPress sites use Le Truffe theme and which version is running. If the version is <= 1.1.7, contact the theme developers immediately to request a patch, or evaluate temporary theme disabling until an update becomes available. In the meantime, configure WAF rules to detect object injection attempts and monitor access logs for signs of exploitation.
At a glance
- What
- Unauthenticated PHP Object Injection in WordPress theme Le Truffe versions <= 1.1.7. CVE-2026-61998 describes a flaw allowing unauthenticated attackers to inject malicious serialized PHP objects, potentially leading to code execution or sensitive data disclosure.
- Severity
- CVSS 9.8 (critical). The vulnerability enables remote code execution with web server privileges on WordPress sites running the vulnerable theme.
- Affected versions
- Le Truffe versions <= 1.1.7. All installations of the theme up to this version are vulnerable.
- Fix
- Not reported. According to current signals, no official patch is available yet. Check the theme's official channel for updates.
- Status
- Published on NVD on 2026-10-29. Low visibility on social media (1 post on X in the last 24 hours). No confirmed public exploit in available data.
- Action
- WordPress site administrators using Le Truffe must immediately verify which version is running. If <= 1.1.7, contact developers for a patch or evaluate temporary theme disabling. Configure WAF rules and monitor logs for exploitation signs.
Sources: NVD, CVE-2026-61998