# CVE-2026-39555: Elated-Themes Askka PHP object injection in WordPress theme

Source: https://junglewise.ai/threats/cve-2026-39555-elated-themes-askka-php-object-injection-in-wordpress-theme  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-39555 · Severity: high · CVSS 8.1 · Published 2026-06-02

The Askka theme for WordPress contains a security flaw that allows attackers to inject malicious data into the website's processing engine. If exploited, this could allow an unauthorized person to take control of the site, access sensitive data, or disrupt services. This type of vulnerability is often targeted in automated mass-attacks against WordPress websites.

Vendors: [Elated-Themes](https://junglewise.ai/threats/vendors/elated-themes).

## Quick answers

**Is CVE-2026-39555 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39555 being exploited in the wild.

**How severe is CVE-2026-39555?** High severity, with a CVSS score of 8.1, published 2 June 2026.

**Which products and versions are affected?** Elated-Themes Askka <= 1.3.1.

**Is there a fix for CVE-2026-39555?** A patch was published on 2026-04-08: Version 1.4 released to address the issue Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39555 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-39555?** Check whether you run Elated-Themes Askka at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A PHP Object Injection vulnerability exists in the Elated-Themes Askka theme through version 1.3.1 due to the insecure deserialization of user-supplied data (CWE-502). An unauthenticated remote attacker can exploit this by submitting specially crafted input to a vulnerable component. If a suitable Property-Oriented Programming (POP) chain is present within the environment, this can lead to various high-impact outcomes including arbitrary code execution, SQL injection, or file system traversal. The vulnerability is mitigated in version 1.4.

## Affected products

- Elated-Themes Askka <= 1.3.1

## Timeline

- 2026-02-12: other: Vulnerability reported by Denver Jackson
- 2026-04-08: advisory: Patchstack published advisory
- 2026-06-02: disclosed: CVE published to NVD
- 2026-04-08: patched: Version 1.4 released to address the issue

## References

- [https://patchstack.com/database/wordpress/theme/askka/vulnerability/wordpress-askka-theme-1-3-1-php-object-injection-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/theme/askka/vulnerability/wordpress-askka-theme-1-3-1-php-object-injection-vulnerability?_s_id=cve)