CVE-2026-27429: WordPress Nifty theme <= 1.4.1 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a class of vulnerability where attacker-supplied data is passed to PHP's unserialize() function without validation, allowing the attacker to instantiate arbitrary PHP objects and chain them into destructive operations. This vulnerability in the Nifty WordPress theme (versions 1.4.1 and earlier) is reachable over the network with no authentication required. Successful exploitation gives an attacker full control over confidentiality, integrity, and availability of the affected site, including the ability to read sensitive data, modify or delete content, and crash the service. HarborGuard is tracking the upstream advisory for patch availability, as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable deserialization endpoint is exposed over the network, meaning an attacker must be able to send HTTP requests to the WordPress installation but requires no prior foothold on the host.

• AuthenticationNot required

  No account or session credentials are needed; the injection can be triggered by an unauthenticated request.

• Victim interactionNot required

  The attacker does not need to trick any user into taking an action; exploitation is entirely server-side.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental configuration beyond reaching the service.

Blast Radius

• A successful attacker reads arbitrary files on the server, including WordPress configuration files that contain database credentials and secret keys.
• The attacker modifies or deletes database content, including posts, user accounts, and plugin settings.
• Crafted object chains can execute OS-level commands on the host, giving the attacker a remote shell if a suitable gadget chain exists in the installed PHP environment.
• The attacker crashes PHP worker processes or exhausts server resources, taking the site offline.