CVE-2026-39577: WordPress Playroom theme <= 1.4.1 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability where attacker-controlled input is passed to PHP's unserialize() function, allowing the attacker to instantiate arbitrary objects and potentially trigger dangerous code paths. This vulnerability in the WordPress Playroom theme (versions 1.4.1 and below) is reachable over the network with no authentication required, meaning any external party can send a crafted request. Successful exploitation enables limited reads of sensitive data and limited modification of application data within a changed security scope. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker can send a crafted request from a remote host without any prior foothold on the server.

• AuthenticationNot required

  No credentials are needed; the injection point is reachable by any unauthenticated HTTP request, making this exploitable by arbitrary external actors.

• Victim interactionNot required

  Exploitation is fully server-side and requires no action from any user or administrator on the target site.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and repeatable without depending on race conditions, specific memory layouts, or other variable environmental factors.

Blast Radius

• An attacker can read a limited subset of data accessible to the web application, such as configuration values or session-adjacent information exposed within the changed security scope.
• An attacker can modify a limited subset of application data, such as theme settings or serialized option values stored by the affected plugin context.
• The vulnerability carries no direct availability impact, so service continuity is not disrupted by exploitation alone.
• Because the scope is changed (S:C in the CVSS vector), impact may extend beyond the theme itself to other components or data within the WordPress installation that share the same runtime context.