Le Truffe
Monthly
Signals conflict in a way worth stating plainly: the Le Truffe WordPress theme through version 1.1.7 contains an unauthenticated PHP object injection (CWE-502) scored CVSS 9.8, but whether it yields code execution or other high-impact actions depends on a suitable POP gadget chain in the loaded WordPress core, plugins, or theme code. Patchstack is the reporting source and the vuln.today decision label is act_now; no public exploit identified at time of analysis, and the vulnerable parameter and endpoint are not described in the supplied data.
Signals conflict in a way worth stating plainly: the Le Truffe WordPress theme through version 1.1.7 contains an unauthenticated PHP object injection (CWE-502) scored CVSS 9.8, but whether it yields code execution or other high-impact actions depends on a suitable POP gadget chain in the loaded WordPress core, plugins, or theme code. Patchstack is the reporting source and the vuln.today decision label is act_now; no public exploit identified at time of analysis, and the vulnerable parameter and endpoint are not described in the supplied data.