CVE-2026-40751: WordPress Ashtanga theme <= 1.2 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a class of vulnerability where attacker-controlled data is passed to PHP's unserialize() function, allowing the attacker to instantiate arbitrary PHP objects and chain them into dangerous operations. The Ashtanga WordPress theme versions 1.2 and earlier are affected, and the vulnerability is reachable over the network with no authentication required. Successful exploitation gives an attacker full read, write, and availability impact on the affected host, depending on what PHP classes are available in the target environment. HarborGuard is tracking this advisory for patch availability, as no fix version has been published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable deserialization endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the WordPress installation.

• AuthenticationNot required

  No account or session token is needed; the injection can be triggered by an anonymous request.

• Victim interactionNot required

  The attack is fully server-side and does not require any action from a logged-in user or site visitor.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must identify a suitable POP (property-oriented programming) gadget chain among the PHP classes loaded by the target environment, which depends on what other plugins or libraries are present.

Blast Radius

• A successful attacker can read arbitrary files on the server, including WordPress configuration files that contain database credentials and secret keys.
• An attacker can write or modify files on the server, enabling persistent backdoor placement or defacement of site content.
• An attacker can disrupt availability of the service, for example by deleting critical files or exhausting server resources through crafted object chains.
• The combination of full confidentiality, integrity, and availability impact means a compromised host can be pivoted into the broader container network if network policies do not isolate the workload.