CVE-2026-39557: WordPress NeoBeat theme <= 1.7 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability in the NeoBeat WordPress theme (versions 1.7 and earlier) where attacker-controlled data is passed to PHP's unserialize() function without validation, allowing an attacker to instantiate arbitrary PHP objects. The vulnerability is reachable over the network with no authentication required, though exploitation depends on the presence of a suitable gadget chain in the application or its dependencies. Successful exploitation can result in full compromise of confidentiality, integrity, and availability of the affected site. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress installation over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No account or session credentials are required; the vulnerable deserialization path is exposed to unauthenticated requests.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server and no user action is required to trigger deserialization.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must identify or construct a viable PHP gadget chain present in the application or its installed dependencies, which introduces an environmental dependency beyond the attacker's direct control.

Blast Radius

• A successful attacker who finds a working gadget chain can read arbitrary files on the server, including wp-config.php, exposing database credentials and secret keys.
• Object instantiation with a write-capable gadget allows the attacker to create or overwrite files on the server, enabling webshell deployment or content tampering.
• Certain gadget chains can trigger resource exhaustion or process crashes, taking the WordPress site offline.
• With database credentials exposed, the attacker gains direct access to all stored site content, user records, and session data.