CVE-2026-39560: WordPress Hiroshi theme <= 1.5.1 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability in the WordPress Hiroshi theme (versions 1.5.1 and earlier) where untrusted user-supplied data is passed to PHP's unserialization function without validation. The flaw is reachable over the network without any authentication, though exploitation requires specific environmental conditions to chain into a complete attack. A successful attacker can read sensitive data, modify site content, or crash the affected service depending on what PHP classes are available on the target installation. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable deserialization endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationNot required

  No account or session token is needed; the injection can be triggered by an anonymous HTTP request.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator of the site.

• Attack complexityDetail

  Exploitation is rated High complexity because it depends on the presence of a suitable PHP class chain (a so-called POP chain) in the installed codebase, introducing environmental variability beyond the attacker's direct control.

Blast Radius

• A successful attacker reads confidential data stored by the WordPress installation, including database credentials, API keys, and user records.
• An attacker modifies persisted site content or injects malicious code into theme files or the database.
• Depending on available POP chains, an attacker executes arbitrary operating-system commands on the web server hosting the site.
• The affected service can be crashed or rendered unavailable by triggering a fatal error during the unserialization process.