CVE-2026-40752: WordPress Manufaktur Solutions theme <= 1.1.1 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability class where attacker-controlled input is passed to PHP's unserialize() function, allowing attackers to manipulate application objects and trigger unintended code paths. This vulnerability in the Manufaktur Solutions WordPress theme (versions 1.1.1 and earlier) is reachable over the network with no authentication required, though exploitation requires meeting specific environmental conditions. Successful exploitation gives the attacker full read, write, and availability impact over the affected system, depending on available PHP gadget chains in the environment. No fix version has been published; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerability is reachable over the network; the attacker must be able to send HTTP requests to the WordPress installation running the affected theme.

• AuthenticationNot required

  No account or session credentials are needed; the injection vector is accessible to unauthenticated requests.

• Victim interactionNot required

  Exploitation is fully server-side; no user action such as clicking a link or loading a page is required from any victim.

• Attack complexityDetail

  Attack complexity is rated High, meaning the attacker must account on environmental factors such as the presence of a suitable PHP gadget chain in the application's dependency set; the exploit is not reliably condition-free.

Blast Radius

• An attacker with a working gadget chain can read arbitrary files on the server, including WordPress configuration files containing database credentials and secret keys.
• Object manipulation can overwrite or delete persisted files and database records accessible to the PHP process.
• Depending on available gadgets, the attacker may achieve remote code execution, running arbitrary commands under the web server process account.
• Service availability can be disrupted by triggering destructors or error states that crash the PHP process or exhaust server resources.