CVE-2026-39576: WordPress SingleMalt theme <= 1.5 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a deserialization vulnerability affecting the WordPress SingleMalt theme at version 1.5 and earlier. The flaw is reachable over the network with no authentication required, though exploitation involves conditions that require some attacker effort. Successful exploitation gives an attacker full read, write, and availability control over the host, depending on what PHP classes are available in the target environment. No fix version has been published yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationNot required

  No account or session credential is needed; the injection can be triggered by an unauthenticated HTTP request.

• Victim interactionNot required

  No user action is required; the attacker sends a crafted request directly to the server without any social engineering step.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must account for environmental factors such as the specific PHP classes loaded in the target application that can be chained into a usable gadget chain.

Blast Radius

• A successful attacker can read arbitrary files on the server, including WordPress configuration files containing database credentials and secret keys.
• An attacker can write or modify files on the server, enabling persistent backdoor placement or defacement of site content.
• An attacker can disrupt or crash the affected service, causing a denial of service for the WordPress installation.
• The precise impact depends on which PHP gadget chains are available in the target environment, but CVSS rates Confidentiality, Integrity, and Availability as all High.