CVE-2026-39550: WordPress Aperitif theme <= 1.6 - PHP Object Injection vulnerability

Synopsis

PHP object injection via unsafe deserialization affects the Aperitif WordPress theme (versions 1.6 and earlier), developed by Elated-Themes. The vulnerability is reachable over the network without any authentication, though exploitation requires meeting specific environmental or timing conditions. Successful exploitation gives an attacker full control over confidentiality, integrity, and availability of the affected system, up to and including remote code execution depending on available PHP gadget chains. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker can reach it from the internet without requiring local or adjacent-network access.

• AuthenticationNot required

  No account or credentials are needed; the attacker can send a malicious payload as an unauthenticated request.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is required; the attacker triggers the vulnerability directly.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must account for specific environmental conditions, timing factors, or the presence of a suitable PHP gadget chain in the application's dependency tree.

Blast Radius

• Reads any data the PHP process can access, including WordPress database credentials, stored session tokens, and user records.
• Modifies or deletes persisted data such as database rows, uploaded files, and theme configuration, depending on available gadget chains.
• Crashes or degrades the affected WordPress service, causing denial of access for end users.
• On installations where a usable PHP gadget chain exists, achieves arbitrary remote code execution on the host running WordPress.