CVE-2026-61998

Summary

The Le Truffe plugin for WordPress versions <= 1.1.7 contains an unauthenticated PHP Object Injection vulnerability (CWE-502) due to unsafe deserialization of user-supplied data, allowing remote attackers to execute arbitrary code or cause denial of service without authentication.

Exploitability

Exploitation is straightforward for an attacker with network access since no authentication or user interaction is required.

Blast radius

Successful exploitation could lead to full system compromise including remote code execution, data exfiltration, and service disruption across any WordPress site running the vulnerable plugin.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Le Truffe version 1.1.8 or later, which contains a fix for the unauthenticated PHP Object Injection vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.