{"id":"CVE-2026-61998","kind":"vulnerability","aliases":["CVE-2026-61998"],"related":[],"title":"Le Truffe WordPress plugin: unauthenticated PHP object injection, versions 1.1.7 and below","description":"Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions.","summary":"Le Truffe versions up to 1.1.7 accept untrusted input that is passed to PHP's object deserialization without checks. A remote, unauthenticated attacker can use this to inject objects and may be able to run code on the server.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Le Truffe (letruffe)","fixed":[],"affected":"<= 1.1.7","ecosystem":"wordpress-theme"}],"ecosystems":[],"tags":["le-truffe","package","php","php-object-injection","themerex","wordpress","wordpress-theme"],"not_affected_if":["plugin-not-installed","theme-not-installed"],"how_to_check":"In WordPress admin go to Appearance > Themes and check whether Le Truffe is installed and its version (<= 1.1.7 is vulnerable), or read the Version line in wp-content/themes/letruffe/style.css. Inactive but installed themes may still be reachable.","fix":null,"status":"open","published_at":"2026-10-29T16:18:12+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","triaged_at":"2026-10-29T16:27:34+00:00","updated_at":"2026-10-29T16:31:41+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T16:27:34Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Le Truffe WordPress plugin: unauthenticated PHP object injection, versions 1.1.7 and below","impact":"high","summary":"Le Truffe versions up to 1.1.7 accept untrusted input that is passed to PHP's object deserialization without checks. A remote, unauthenticated attacker can use this to inject objects and may be able to run code on the server.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","le-truffe","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker may run code on the server via object injection.","analyst_note":"Confirm the fixed version and the vulnerable endpoint from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-61998 or the plugin vendor's changelog.","how_to_check":"- Check the installed Le Truffe plugin version in the plugin list or its main plugin file header.\n- Confirm whether the plugin is active on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running Le Truffe at version 1.1.7 or earlier are exposed, as the description covers all versions up to that release. The sources do not say which request path or setting is involved, so whether a default install is reachable is unknown. Sites without the plugin installed can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000676,"input_tokens":4055,"output_tokens":541,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the vulnerable endpoint from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-61998 or the plugin vendor's changelog.","search":"'-2026':12A,15A '-61998':13A,16A '1.1.7':10A,39B,80C 'abl':66B 'accept':40B 'attack':56B 'check':52B 'code':69B 'cve':11A,14A 'deseri':50B 'inject':8A,28B,61B,76C 'input':42B 'le':1A,17A,21B,34B,78C 'le-truff':20B 'letruffe':19A 'may':64B 'object':7A,27B,49B,62B,75C 'packag':23B 'pass':45B 'php':6A,24B,26B,47B,74C 'php-object-inject':25B 'plugin':4A 'remot':54B 'run':68B 'server':72B 'theme':33B 'themerex':29B 'truff':2A,22B,35B,79C 'truffe':18A 'unauthent':5A,55B,73C 'untrust':41B 'use':58B 'version':9A,36B,81C 'without':51B 'wordpress':3A,30B,32B 'wordpress-them':31B","nicknames":[],"mitigations":[],"who_affected":"Le Truffe is a ThemeREX WordPress theme (not a plugin). Any WordPress site with the Le Truffe theme at 1.1.7 or older installed is exposed to an unauthenticated attacker, who can send crafted data that gets deserialized by PHP. Sites using other themes, or without Le Truffe installed, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T16:18:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61998","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61998","severity":null,"published_at":"2026-10-29T16:18:12+00:00","modified_at":"2026-10-29T16:20:19+00:00","first_seen_at":"2026-10-29T16:26:00+00:00","fetched_at":"2026-10-29T16:26:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-61998:1051","url":null,"severity":null,"published_at":"2026-10-29T16:31:41+00:00","modified_at":"2026-10-29T16:31:41+00:00","first_seen_at":"2026-10-29T16:31:41+00:00","fetched_at":"2026-10-29T16:31:41+00:00","note":"Patchstack (only source read; NVD page returned nothing) says the affected product is the Le Truffe THEME (ThemeREX), <=1.1.7, unauthenticated, CVSS 9.8, no official patch as of 2026-10-12, reported by johska. Triage said 'plugin' - wrong. Vulnerable endpoint not identified. No vendor page found, so nothing marked verified; fix-status none rests on Patchstack only. Not seen exploited; no PoC found. Sibling CVE-2026-28069 (LFI) affects same theme. Workaround: remove or replace the theme, or use a WAF rule (Patchstack has one)."}],"documents":[{"id":17752,"url":"https://patchstack.com/database/wordpress/theme/letruffe/vulnerability/wordpress-le-truffe-theme-1-1-7-php-object-injection-vulnerability","title":"Patchstack: Le Truffe theme <= 1.1.7 PHP Object Injection","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}