CVE-2026-39573: WordPress Mildhill theme <= 1.5 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability where an attacker sends a crafted, serialized data payload to the application, tricking it into instantiating arbitrary PHP objects and executing unintended code or logic. The Mildhill WordPress theme (versions 1.5 and earlier) is affected and the vulnerability is reachable over the network with no authentication required, though exploitation requires navigating environmental conditions that raise attack complexity. Successful exploitation gives an attacker full control over confidentiality, integrity, and availability of the affected environment. No fix version has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the affected service over the network; no local or physical access is assumed by the CVSS vector (AV:N).

• AuthenticationNot required

  No account or session credential is needed; the vulnerable endpoint accepts unauthenticated requests (PR:N).

• Victim interactionNot required

  The attacker does not need to socially engineer or involve any user to trigger the vulnerability (UI:N).

• Attack complexityDetail

  Exploitation is rated high complexity (AC:H), meaning the attacker must account for environmental or timing factors such as specific server-side class availability (gadget chains) to turn object injection into meaningful impact.

Blast Radius

• A successful attacker can read any data the PHP process has access to, including database credentials, session tokens, and configuration secrets stored on the server.
• A successful attacker can write or modify files and database records, enabling content tampering, backdoor installation, or privilege escalation within the WordPress installation.
• A successful attacker can crash or hang the web server process, taking the affected site offline.