CVE-2026-40733: WordPress ShiftUp theme <= 1.3 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability class where an attacker sends crafted serialized data to an application, tricking it into instantiating arbitrary PHP objects and executing unintended logic. The ShiftUp WordPress theme (versions 1.3 and below) contains this flaw, reachable over the network without any authentication. Depending on other code present in the WordPress installation, successful exploitation can lead to full data disclosure, data tampering, or remote code execution. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is reachable over the network, so an attacker must be able to send HTTP requests to the WordPress installation.

• AuthenticationNot required

  No account or session token is needed; the injection can be triggered by an unauthenticated request.

• Victim interactionNot required

  No user action or social-engineering step is needed; the attacker sends the payload directly to the application.

• Attack complexityDetail

  Attack complexity is rated High, meaning reliable exploitation depends on environmental factors such as the presence of a suitable PHP gadget chain within the installed plugin or theme codebase.

Blast Radius

• A successful attacker can read confidential data stored by WordPress, including user credentials, session tokens, and any customer records held in the database.
• An attacker can modify or delete persisted database rows, altering site content, injecting malicious scripts, or destroying data.
• Where a usable PHP gadget chain exists in the environment, an attacker can achieve remote code execution, running arbitrary commands inside the container.