CVE-2026-40735: WordPress Reina theme <= 2.1 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is an unauthenticated remote vulnerability affecting the Reina WordPress theme (versions 2.1 and earlier), developed by Edge-Themes. The flaw is exploitable over the network without any login credentials, though certain environmental conditions must align for the attack to succeed. Successful exploitation gives an attacker full read, write, and crash capability over the affected site. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress service over the network; there is no requirement for local or physical access.

• AuthenticationNot required

  No account or session token is needed; the injection point is accessible to unauthenticated HTTP requests.

• Victim interactionNot required

  The attack is fully server-side and does not require any action from a logged-in user or administrator.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker depends on specific environmental conditions such as a suitable POP chain being present in the loaded PHP class context, making reliable exploitation conditional rather than straightforward.

Blast Radius

• A successful attacker can read arbitrary files and sensitive data stored on the server, including WordPress database credentials and session secrets.
• An attacker can write or modify files on the server by invoking deserialization gadget chains that trigger filesystem operations, enabling backdoor placement or content tampering.
• The service can be crashed or rendered unavailable by triggering destructors or error states through the injected object graph.