CVE-2026-39445: WordPress Alukas theme < 3.0.0 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability in the PressLayouts Alukas WordPress theme affecting all versions before 3.0.0. An unauthenticated remote attacker can exploit this by sending a crafted HTTP request over the network, with no login or user interaction required; exploiting the vulnerability requires overcoming some environmental conditions due to its high attack complexity. Successful exploitation gives an attacker full read, write, and availability impact on the affected system. A patched-image rebuild at version 3.0.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; the theme's vulnerable deserialization endpoint is exposed via standard HTTP.

• AuthenticationNot required

  No account or session token is needed; the vulnerable code path is reachable by any anonymous HTTP request.

• Victim interactionNot required

  The attacker does not need to trick or wait for any user to take an action; exploitation is fully server-side.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must account for environmental factors such as a suitable PHP gadget chain being present in the application's dependency set before the injection becomes weaponizable.

Blast Radius

• An attacker who successfully triggers a gadget chain can read arbitrary files and application secrets from the server, including database credentials and API keys.
• If a write-capable gadget chain is available, the attacker can create or overwrite files on disk, enabling persistent backdoors or web shells.
• Exploitation can crash or hang the PHP process, taking the WordPress site offline and disrupting service for end users.
• All three impacts (read, write, availability) are rated High in the CVSS vector, meaning none of them are partial; a fully realized exploit achieves each at maximum severity.