CVE-2026-40738: WordPress Eldon theme <= 1.4.1 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability where attacker-controlled data is passed to PHP's unserialize() function, causing the application to instantiate arbitrary objects and potentially execute attacker-chosen code. This vulnerability in the Eldon WordPress theme (versions 1.4.1 and earlier) is reachable over the network with no authentication required, and the exploit path involves non-trivial timing or environmental conditions per the CVSS vector. Successful exploitation gives an attacker full read, write, and availability impact against the affected host. No upstream fix has been published; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via HTTP/HTTPS to deliver a malicious serialized payload.

• AuthenticationNot required

  No account or session credentials are needed; the injection point is accessible to unauthenticated requests.

• Victim interactionNot required

  No user action is needed on the target site; the attacker sends the payload directly without requiring any click or navigation by a victim.

• Attack complexityDetail

  Attack complexity is rated High, meaning the exploit depends on specific environmental conditions, memory layout, or the presence of a suitable POP chain in the installed PHP codebase rather than being reliably condition-free.

Blast Radius

• A successful attacker reads arbitrary files and sensitive data from the server, including credentials, keys, and customer records stored on the host.
• A successful attacker writes or modifies files on the server, enabling persistent backdoors or tampering with application logic.
• A successful attacker can crash or disable the WordPress service, causing a denial of service for the affected site.
• If a usable POP chain exists in the installed PHP dependencies, the attacker executes arbitrary operating-system commands on the host.