CVE-2026-40756: WordPress Zoya theme <= 1.4 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a class of vulnerability where attacker-controlled data is passed to PHP's unserialize() function, allowing the attacker to instantiate arbitrary objects and trigger unintended code paths. The Zoya WordPress theme (versions 1.4 and below) is affected, and the vulnerability is reachable over the network without any authentication. Depending on what other PHP classes are loaded in the application, successful exploitation can enable full confidentiality loss, data tampering, and service disruption. No fix version has been published yet; HarborGuard tracks the upstream advisory and will make a patched rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker can reach it from the internet without requiring local or adjacent-network access.

• AuthenticationNot required

  No account or credentials of any privilege level are needed; the injection point is reachable by any unauthenticated HTTP request.

• Victim interactionNot required

  The attacker does not need to involve or trick any user; the attack is executed entirely server-side.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must account for environmental conditions such as the availability of a suitable PHP gadget chain in the target application's class scope, making reliable exploitation conditional on target configuration.

Blast Radius

• A successful attacker can read sensitive data from the WordPress installation, including database credentials, API keys, and stored user records, depending on the gadget chain available.
• The attacker can modify or delete persisted data, including WordPress posts, settings, and user account details, if a writable gadget is present.
• The attacker can crash or destabilize the PHP runtime or web server process, taking the site offline.