Le Truffe CVE-2026-61998

The target must be running the ThemeRex 'Le Truffe' WordPress theme at version 1.1.7 or earlier, with the vulnerable deserialization code path reachable by an unauthenticated network request (consistent with AV:N/PR:N/UI:N). The specific parameter, endpoint, or SAPI that reaches unserialize() is not described in the available sources. The principal limiting factor is that PHP object injection yields code execution or high-impact actions only when a suitable POP gadget chain exists in the loaded WordPress core, plugins, or theme code; without such a chain, impact may be reduced to a lesser effect. No authentication, non-default configuration, or user interaction is required according to the supplied vector.

Signals conflict in a way worth stating plainly. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H → 9.8) and the vuln.today 'act_now' decision label both argue for urgent treatment: a network-reachable, unauthenticated flaw with no user interaction and full confidentiality/integrity/availability impact. CWE-502 (deserialization) in a WordPress theme is a well-understood, high-impact class. However, several corroborating risk signals are ABSENT rather than negative: no EPSS exploitation-probability score is provided, the CVE is NOT listed in CISA KEV, and no confirmed public exploit code is present - the single reference is a Patchstack advisory, not a weaponized PoC. The real-world footprint is also low: 'Le Truffe' is a niche ThemeRex WordPress theme, so even a CRITICAL rating translates to a small absolute attack surface. Net assessment: this is a genuinely severe vulnerability by mechanism and CVSS, and the 'act_now' label should be honored for anyone actually running the theme, but there is no evidence yet of widespread or active exploitation - treat it as high-priority patching for affected sites rather than an emergency fleet-wide incident. Note also that object-injection impact (C:H/I:H/A:H) is realized only when a usable POP gadget chain exists in the loaded WordPress/PHP code; the description does not confirm the trigger, so the maximal CVSS impact is an upper bound.

A remote attacker sends a crafted request to a WordPress site running the Le Truffe theme (≤ 1.1.7) containing a serialized PHP object in an attacker-controlled parameter that reaches an unserialize() call. Because CVSS indicates no authentication and no user interaction (PR:N/UI:N) over the network (AV:N/AC:L), exploitation needs no login or victim action. Actual code execution or data compromise depends on a usable POP gadget chain being present; no confirmed public exploit code was identified at time of analysis - only a Patchstack advisory reference.