PT-2026-45732 · Elated Themes · Töbel

Denver Jackson · CVE-2026-39551 · Published 2026-06-02 · Updated 2026-06-02

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Töbel versions prior to 1.8.2

Description Untrusted data deserialization in the software allows for object injection. Object injection occurs when an application deserializes a malicious object, potentially leading to arbitrary code execution or other unauthorized actions.

Recommendations Update to a version newer than 1.8.1.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2026-39551

Affected Products

Töbel

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-39551 · Security Note
• https://patchstack.com/database/wordpress/theme/tobel/vulnerability/wordpress-toebel-theme-1-8-1-php-object-injection-vulnerability?_s_id=cve · Note