Is CVE-2026-39555 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39555 being exploited in the wild.

How severe is CVE-2026-39555?

High severity, with a CVSS score of 8.1, published 2 June 2026.

Is there a fix for CVE-2026-39555?

A patch was published on 2026-04-08: Version 1.4 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-39555 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-39555?

Check whether you run Elated-Themes Askka at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39555: Elated-Themes Askka PHP object injection in WordPress theme

CVE-2026-39555 · Severity: high · CVSS 8.1 · Published 2026-06-02

The Askka theme for WordPress contains a security flaw that allows attackers to inject malicious data into the website's processing engine. If exploited, this could allow an unauthorized person to take control of the site, access sensitive data, or disrupt services. This type of vulnerability is often targeted in automated mass-attacks against WordPress websites.

Vendors: Elated-Themes.

Quick answers

Is CVE-2026-39555 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39555 being exploited in the wild.
How severe is CVE-2026-39555?: High severity, with a CVSS score of 8.1, published 2 June 2026.
Which products and versions are affected?: Elated-Themes Askka <= 1.3.1.
Is there a fix for CVE-2026-39555?: A patch was published on 2026-04-08: Version 1.4 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-39555 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-39555?: Check whether you run Elated-Themes Askka at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A PHP Object Injection vulnerability exists in the Elated-Themes Askka theme through version 1.3.1 due to the insecure deserialization of user-supplied data (CWE-502). An unauthenticated remote attacker can exploit this by submitting specially crafted input to a vulnerable component. If a suitable Property-Oriented Programming (POP) chain is present within the environment, this can lead to various high-impact outcomes including arbitrary code execution, SQL injection, or file system traversal. The vulnerability is mitigated in version 1.4.

Affected products

Elated-Themes Askka <= 1.3.1

Timeline

2026-02-12: other: Vulnerability reported by Denver Jackson
2026-04-08: advisory: Patchstack published advisory
2026-06-02: disclosed: CVE published to NVD
2026-04-08: patched: Version 1.4 released to address the issue

References

https://patchstack.com/database/wordpress/theme/askka/vulnerability/wordpress-askka-theme-1-3-1-php-object-injection-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.