What is the CVSS score of CVE-2026-39551?

CVE-2026-39551 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Töbel WordPress Theme are affected by CVE-2026-39551?

The Elated-Themes Töbel WordPress theme (versions ≤1.8.1) contains an unauthenticated remote code execution vulnerability through unsafe object deserialization, exposing any WordPress site running…

How to fix or mitigate CVE-2026-39551?

Within 24 hours: Audit all WordPress installations to identify sites running Töbel theme v1.8.1 or earlier. Within 7 days: Disable the theme and switch to an alternative, or apply WAF rules to block serialized object payloads; restrict theme file access if remediation is not immediately possible. Within 30 days: Verify all affected installations have migrated away from Töbel or wait for Elated-Themes patch release; confirm no backdoors were installed during exposure window.

Töbel WordPress Theme CVE-2026-39551

EUVD-2026-33912 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-02 Patchstack

GHSA-2w4f-7crj-wgcm

Deserialization T Bel

8.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 02, 2026 - 11:51 vuln.today

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Elated-Themes Töbel allows Object Injection.

This issue affects Töbel: from n/a through 1.8.1.

AnalysisAI

PHP object injection in the Elated-Themes Töbel WordPress theme (versions up to and including 1.8.1) allows remote attackers to trigger unsafe deserialization of attacker-controlled data, potentially leading to arbitrary code execution, file manipulation, or data tampering depending on available POP gadgets. Rated CVSS 8.1 (High) with no public exploit identified at time of analysis and no CISA KEV listing, though the network attack vector and lack of authentication requirement make it a meaningful risk to any WordPress site running the theme.

Technical ContextAI

Töbel is a commercial WordPress theme distributed by Elated-Themes. The flaw is classified as CWE-502 (Deserialization of Untrusted Data), meaning the theme passes attacker-supplied input into PHP's unserialize() function (or an equivalent path) without validating the source or contents. In WordPress ecosystems this class of bug becomes exploitable via Property-Oriented Programming (POP) chains assembled from gadgets present in WordPress core, other active plugins/themes, or Composer dependencies, allowing an attacker to instantiate arbitrary objects and trigger magic methods such as __wakeup or __destruct on deserialization.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory lists affected versions through 1.8.1 with no fixed release noted, so site owners should monitor https://patchstack.com/database/wordpress/theme/tobel/vulnerability/wordpress-toebel-theme-1-8-1-php-object-injection-vulnerability and the Elated-Themes vendor site for an updated build and apply it as soon as it ships. Until a fix is published, consider deactivating and removing the Töbel theme on production sites (trade-off: site appearance reverts to a fallback theme), placing the site behind a WAF with rules that block serialized PHP payloads (e.g., strings beginning with O:, a:, s: in request parameters - trade-off: potential false positives on legitimate serialized data), and restricting access to any theme endpoints/AJAX actions used by Töbel via .htaccess or web-server ACLs (trade-off: may break theme features that depend on those endpoints).