CVE-2026-39443: WordPress EmallShop theme <= 2.4.21 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability in the EmallShop WordPress theme (versions 2.4.21 and earlier) where attacker-controlled data is passed to PHP's unserialize() function without validation. An unauthenticated attacker can reach this flaw directly over the network with no login required, though exploitation depends on the availability of a suitable POP chain in the target environment. Successful exploitation enables full confidentiality loss, data tampering, and service disruption up to and including remote code execution. No upstream fix has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so the attacker must be able to send HTTP requests to the WordPress installation.

• AuthenticationNot required

  No account or session credentials are needed; the injection point is reachable by any unauthenticated request.

• Victim interactionNot required

  The attacker does not need any action from a site user or administrator to trigger deserialization.

• Attack complexityDetail

  Exploitation is rated High complexity because it requires a usable POP (Property-Oriented Programming) chain to be present in the PHP environment, which depends on other installed packages and their class definitions.

Blast Radius

• A successful attacker can read arbitrary files and application secrets, including database credentials, API keys, and stored user data.
• The attacker can modify or delete database records and site content by chaining the injection to writable objects in the PHP environment.
• If a suitable RCE-capable POP chain exists, the attacker gains arbitrary command execution on the host running PHP, extending impact beyond the WordPress application itself.
• The service can be crashed or rendered unavailable by triggering destructors that corrupt application state or exhaust resources.