CVE-2026-39578

Name of the Vulnerable Software and Affected Versions Valiance versions prior to 1.3

Description An issue exists where unauthenticated attackers can perform PHP Object Injection via the deserialization of untrusted input. Deserialization is the process of converting a stored data format back into an object. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain through other installed plugins or themes could allow an attacker to execute code, retrieve sensitive data, or delete arbitrary files.

Recommendations Update to a version later than 1.2.