CVE-2026-40739: WordPress LuxeDrive theme <= 1.4 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a class of vulnerability where attacker-supplied data is passed to PHP's unserialize() function without validation, allowing the attacker to instantiate arbitrary PHP objects and potentially chain them into destructive operations. This vulnerability in the LuxeDrive WordPress theme (versions 1.4 and below) is reachable over the network and requires no authentication or user interaction. Successful exploitation gives an attacker full read, write, and availability impact against the affected host, depending on what PHP classes are available in the runtime environment. No fix version has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable deserialization endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the WordPress installation.

• AuthenticationNot required

  No account or session token is needed; the injection can be triggered by an unauthenticated request.

• Victim interactionNot required

  The attacker does not need to trick or involve any user; the exploit is entirely server-side.

• Attack complexityDetail

  Attack complexity is rated High, meaning exploitation depends on environmental factors such as the presence of a suitable PHP class chain (gadget chain) in the runtime; the exploit is not reliably condition-free.

Blast Radius

• A successful attacker can read arbitrary files and data accessible to the PHP process, including WordPress database credentials and stored user session tokens.
• The attacker can write or modify files on the server, enabling persistent backdoor installation or defacement of site content.
• Depending on the available gadget chain, the attacker may achieve remote code execution on the host running the WordPress application.
• The exploit can crash or destabilize the PHP runtime through destructors in the gadget chain, causing service disruption for the affected site.