CVE-2026-39442: WordPress PressMart theme <= 1.2.26 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a class of vulnerability where an attacker supplies crafted serialized data that the application deserializes without validation, allowing arbitrary PHP objects to be instantiated and their methods executed. The PressMart WordPress theme, versions 1.2.26 and earlier, contains this flaw and is reachable over the network with no authentication required. Depending on the PHP classes available in the application (known as a "POP chain"), successful exploitation can lead to full compromise of confidentiality, integrity, and availability of the affected host. No fix version has been published; HarborGuard tracks this advisory and will surface a patched rebuild the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via standard HTTP/HTTPS to deliver the malicious serialized payload.

• AuthenticationNot required

  No account or credentials of any kind are needed; the injection point is accessible to unauthenticated requests.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server; no user action, click, or session is required to trigger deserialization.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker likely depends on specific POP chain classes being present in the environment or on timing and configuration factors outside their direct control.

Blast Radius

• A successful attacker can read arbitrary files and application data on the server, including WordPress database credentials and stored user records.
• An attacker can write or modify files on the server, enabling persistent backdoor installation or defacement of site content.
• Depending on the available POP chain, remote code execution on the host running the WordPress application is achievable.
• The attacker can crash or destabilize the PHP runtime or underlying service, causing denial of service for the hosted site.