CVE-2026-39554

Name of the Vulnerable Software and Affected Versions Fidalgo versions prior to 1.2.3

Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain via another installed plugin or theme could allow the attacker to execute code, retrieve sensitive data, or delete arbitrary files.

Recommendations Update to a version newer than 1.2.2.