CVE-2026-39556

Name of the Vulnerable Software and Affected Versions Konsept versions prior to 2.0

Description The Konsept theme for WordPress allows unauthenticated attackers to perform PHP Object Injection through the deserialization of untrusted input. This occurs when the application processes data that has been serialized and then deserialized without proper validation. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain via other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update to a version newer than 1.9.