CVE-2026-39545: WordPress Zermatt theme <= 1.6.1 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a class of vulnerability where attacker-controlled input is passed to PHP's unserialize() function, allowing the attacker to instantiate arbitrary PHP objects and trigger dangerous code paths already present in the application. The Zermatt WordPress theme (versions 1.6.1 and below) contains such a flaw that is reachable over the network with no authentication required, though exploitation involves elevated attack complexity due to environmental or chaining requirements. Successful exploitation grants the attacker full read, write, and availability impact on the affected host, depending on which PHP classes are available in the environment. HarborGuard is tracking this advisory because no upstream fix has been published yet.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable deserialization endpoint is reachable over the network, so an attacker must be able to send HTTP requests to the target WordPress installation.

• AuthenticationNot required

  No account or session credential is needed; the injection point is accessible to anonymous requests.

• Victim interactionNot required

  The attack is entirely server-side and does not require any action from a logged-in user or administrator.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must identify and chain a suitable PHP class (a gadget chain) already present in the application's dependency tree; this is not a point-and-click exploit.

Blast Radius

• Reads arbitrary files on the server, including WordPress configuration files that contain database credentials and secret keys.
• Writes or overwrites files on the server, enabling the attacker to plant a webshell or modify theme and plugin files.
• Executes operating-system commands if a suitable remote-code-execution gadget chain is available in the installed PHP dependencies.
• Crashes or destabilizes the PHP runtime through destructors in gadget chains, causing service disruption for site visitors.