CVE-2026-39578: WordPress Valiance theme <= 1.2 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability in the Valiance WordPress theme (versions 1.2 and below) where attacker-controlled data is passed to PHP's unserialize() function without validation, allowing crafted input to instantiate arbitrary PHP objects. The CVSS vector indicates the attack is reachable over the network and, despite the description noting 'Unauthenticated', the vector specifies a high-privilege account is required; no victim interaction is needed. Successful exploitation can result in limited unauthorized data disclosure and modification of content within the affected environment. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP/HTTPS.

• AuthenticationRequired

  The CVSS vector specifies PR:H, meaning a high-privilege account (such as a WordPress administrator) is required to reach the vulnerable code path.

• Victim interactionNot required

  No action from a logged-in user or site visitor is needed; the attacker can trigger the vulnerability directly once authenticated.

• Attack complexityDetail

  AC:L indicates the exploit is reliable and requires no special race conditions, memory layout knowledge, or other environmental prerequisites.

Blast Radius

• An attacker can read limited application data, such as theme configuration values or partial content from the WordPress environment (C:L).
• An attacker can modify limited application data, such as altering theme settings or injecting crafted objects that manipulate serialized data flows (I:L).
• Availability of the service is not directly impacted by this vulnerability (A:N).
• Scope is changed (S:C), meaning impact can extend beyond the vulnerable component itself to other components running within the same web application context.