CVE-2026-39445

Name of the Vulnerable Software and Affected Versions Alukas versions prior to 3.0.0

Description Unauthenticated attackers can perform PHP Object Injection through the deserialization of untrusted input. This occurs when the application takes user-supplied data and passes it to the PHP unserialize() function without proper validation. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain via other installed plugins or themes could allow for arbitrary file deletion, retrieval of sensitive data, or remote code execution.

Recommendations Update to version 3.0.0 or later.