Live › vulnerability › CVE-2026-61998
Le Truffe versions up to 1.1.7 accept untrusted input that is passed to PHP's object deserialization without checks. A remote, unauthenticated attacker can use this to inject objects and may be able to run code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 16:26 UTC. All times on this page are UTC.
Le Truffe is a ThemeREX WordPress theme (not a plugin). Any WordPress site with the Le Truffe theme at 1.1.7 or older installed is exposed to an unauthenticated attacker, who can send crafted data that gets deserialized by PHP. Sites using other themes, or without Le Truffe installed, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Le Truffe (letruffe) | wordpress-theme | <= 1.1.7 | – |
1.1.7 is vulnerable), or read the Version line in wp-content/themes/letruffe/style.cssNo fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-61998")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.