CVE-2026-39567: WordPress Santé theme <= 1.5.1 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability in the Santé WordPress theme (versions 1.5.1 and earlier) where unsanitized, attacker-supplied data is passed to PHP's unserialize() function. The vulnerability is reachable over the network with no authentication required, though exploitation depends on environmental factors such as the presence of a suitable PHP object chain (a "POP chain") in the application. Successful exploitation can give an attacker full read, write, and availability impact on the affected system. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network; an attacker must be able to send HTTP requests to the WordPress installation to reach the unserialize() call.

• AuthenticationNot required

  No account or session credentials are needed; the injection point is accessible to unauthenticated HTTP requests.

• Victim interactionNot required

  No user action is required; the attacker interacts directly with the server without any social-engineering step.

• Attack complexityDetail

  Exploitation is rated High complexity because it depends on the presence of a suitable POP chain in the application's loaded PHP classes; the attacker must identify and assemble a viable chain of objects to achieve meaningful impact.

Blast Radius

• A successful attacker can read arbitrary files and sensitive data on the server, including WordPress database credentials and stored user records.
• The attacker can write or modify files on the host, enabling persistent backdoor installation or defacement of site content.
• Depending on the POP chain available, the attacker may achieve remote code execution, running arbitrary commands under the web server process.
• Service availability can be disrupted by triggering destructors or file operations that crash or corrupt the WordPress installation.