CVE-2026-12256: WordPress Avada theme <= 3.15.3 - PHP Object Injection vulnerability

Synopsis

PHP object injection is a vulnerability in the Avada WordPress theme (versions 3.15.3 and earlier) that allows an authenticated attacker to pass crafted serialized PHP data into the application. The attack is reachable over the network and requires only a low-privilege account such as a Contributor-level WordPress user. Successful exploitation enables the attacker to read sensitive data, modify site content, and crash or take over the affected application. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to reach the WordPress instance via standard HTTP/HTTPS traffic.

• AuthenticationRequired

  A low-privilege WordPress account such as Contributor level is sufficient; no administrative access is needed.

• Victim interactionNot required

  The attacker does not need any action from another user to trigger the vulnerability.

• Attack complexityDetail

  Exploit reliability is high and no special environmental conditions, race conditions, or memory layout knowledge are required.

Blast Radius

• A successful attacker reads confidential site data including stored credentials, session tokens, and private post content.
• The attacker modifies or deletes persisted database rows and site files, altering page content or injecting malicious code.
• The attacker crashes or fully compromises the PHP application process, taking over the WordPress installation.
• If a suitable PHP gadget chain exists in the installed dependencies, remote code execution on the host container is achievable.