CVE-2026-39551: WordPress Töbel theme <= 1.8.1 - PHP Object Injection vulnerability

Synopsis

PHP object injection via deserialization of untrusted data in the Elated-Themes Töbel WordPress theme (versions 1.8.1 and earlier). The vulnerability is reachable over the network with no authentication required, though exploitation depends on environmental conditions such as the presence of a usable gadget chain in the PHP environment. Successful exploitation gives an attacker full read, write, and availability impact on the affected site, enabling data theft, content tampering, and service disruption. No fix version has been published; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable theme endpoint is exposed over the network, meaning an attacker must be able to send HTTP requests to the target WordPress installation.

• AuthenticationNot required

  No account or session credential is needed; the deserialization sink is reachable by unauthenticated requests.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is required for exploitation.

• Attack complexityDetail

  Attack complexity is rated High, meaning exploitation is not condition-free: a usable PHP gadget chain must exist in the runtime environment, introducing an environmental dependency the attacker must satisfy.

Blast Radius

• A successful attacker can read arbitrary files and database contents, including stored credentials, session tokens, and customer records.
• An attacker can write or modify persisted data, including WordPress posts, options, and user account records.
• Depending on available gadget chains, an attacker may execute arbitrary PHP code on the server hosting the WordPress installation.
• The affected service can be crashed or rendered unavailable by triggering destructors that corrupt application state.