CVE-2026-39555: WordPress Askka theme <= 1.3.1 - PHP Object Injection vulnerability

Synopsis

PHP object injection via unsafe deserialization affects the Askka WordPress theme by Elated-Themes, versions 1.3.1 and earlier. The vulnerability is reachable over the network without any authentication, though exploitation requires meeting certain environmental or timing conditions derived from the high attack complexity rating. A successful attacker gains full read, write, and crash capability over the affected environment. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as upstream ships a patch.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; no local or physical access is required.

• AuthenticationNot required

  No account or session credentials are needed to send the malicious payload.

• Victim interactionNot required

  The attacker does not need any user or administrator to take an action for exploitation to proceed.

• Attack complexityDetail

  Exploitation is not straightforward; the attacker must account for race conditions, specific memory or object-graph layout, or other environmental factors that make reliable exploitation inconsistent.

Blast Radius

• A successful attacker reads arbitrary files and data stored on the WordPress host, including database credentials, session tokens, and user records.
• The attacker writes or modifies persisted data and files on the server, enabling content tampering, backdoor installation, or privilege escalation within WordPress.
• The attacker can crash or destabilize the affected service, causing a denial of service for visitors and administrators.
• Because PHP object injection can chain existing class methods (POP chains), the attacker may achieve remote code execution depending on the classes available in the application.