CVE-2026-40753: WordPress EasyMeals theme <= 1.5.1 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability where attacker-controlled data is passed to PHP's unserialize() function, allowing the attacker to instantiate arbitrary objects and potentially chain them into dangerous operations. This vulnerability in the EasyMeals WordPress theme (versions 1.5.1 and earlier) is reachable over the network with no authentication required, though exploitation involves elevated complexity. Successful exploitation gives an attacker full read, write, and availability impact against the affected host depending on which PHP classes are available for chaining. No fix version has been published; HarborGuard tracks this advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress site's HTTP interface to deliver a malicious serialized payload.

• AuthenticationNot required

  No account or session token is needed; the injection point is accessible to unauthenticated HTTP requests.

• Victim interactionNot required

  The attacker sends a crafted request directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must identify a suitable PHP class chain (gadget chain) present in the environment and may need to account on specific conditions in the target's class loading context.

Blast Radius

• A successful attacker can read arbitrary files and application data from the server, including WordPress database credentials, secret keys, and stored user records.
• The attacker can write or modify files on the server, enabling webshell placement, theme/plugin tampering, or persistent backdoor installation.
• The attacker can crash or destabilize the PHP process or underlying service, causing denial of service for site visitors and administrators.
• The full scope of impact depends on which PHP classes (gadget chains) are available in the target environment, but CVSS rates Confidentiality, Integrity, and Availability all as High.