CVE-2026-39539: WordPress Alloggio - Hotel Booking theme <= 2.1.2 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a class of vulnerability where attacker-controlled input is passed to PHP's unserialize() function, allowing crafted payloads to manipulate object behavior at runtime. The Alloggio Hotel Booking WordPress theme, versions 2.1.2 and earlier, is affected and the vulnerability is reachable over the network with no authentication required. Successful exploitation, when a suitable PHP property-oriented chain (POP chain) exists in the environment, gives an attacker the ability to read sensitive data, modify server-side state, or execute arbitrary code. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via HTTP/HTTPS from a remote location.

• AuthenticationNot required

  No account or session token is needed; the injection vector is accessible to unauthenticated HTTP requests.

• Victim interactionNot required

  The attack is fully server-side and does not require any user action such as clicking a link or opening a file.

• Attack complexityDetail

  Attack complexity is rated HIGH, meaning exploitation is not condition-free; the attacker likely depends on a usable POP chain being present in the target PHP environment, which varies by installed plugins and themes.

Blast Radius

• An attacker with a working POP chain can read sensitive server-side data, including WordPress database credentials, API keys, and stored user records.
• A successful exploit can modify persisted data such as database rows, configuration files, or user account details.
• Depending on the POP chain available, an attacker can achieve remote code execution on the underlying server hosting the WordPress installation.
• Full compromise of confidentiality, integrity, and availability of the affected WordPress host is within scope of a successful exploitation.