CVE-2026-39446: WordPress Kapee theme < 1.7.0 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability in which an attacker supplies crafted, serialized PHP data to an application that deserializes it without validation, triggering unintended code execution paths. The Kapee WordPress theme before version 1.7.0 is affected, and the vulnerability is reachable over the network with no authentication required. Successful exploitation gives an attacker full read, write, and availability impact on the host, depending on what PHP classes are available in the application (so-called POP chain execution). A patched-image rebuild at version 1.7.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No account or credential of any privilege level is required to trigger the deserialization endpoint.

• Victim interactionNot required

  The attack is entirely server-side; no user action or social engineering is required.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must identify a viable POP chain from available PHP classes and may need to account for environmental conditions such as installed plugins or specific server configurations.

Blast Radius

• A successful attacker reads arbitrary files from the server, including WordPress configuration files containing database credentials and secret keys.
• The attacker writes or modifies files on the server, enabling webshell placement or theme/plugin file tampering.
• The attacker can crash or destabilize the WordPress process, disrupting service availability for site visitors.
• With a suitable POP chain, the attacker achieves remote code execution on the underlying host, moving beyond the WordPress application boundary.