CVE-2026-40757: WordPress Château theme <= 1.2.1 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a class of vulnerability where attacker-controlled data is passed to PHP's unserialize() function, allowing arbitrary objects to be instantiated and their methods invoked. This vulnerability in the Château WordPress theme (versions 1.2.1 and earlier) is reachable over the network and requires no authentication. Successful exploitation gives an attacker full read, write, and disruption capabilities against the affected system, though the actual impact depends on what PHP classes (called gadget chains) are available in the application's environment. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress site over the network; the vulnerable deserialization endpoint is exposed via standard HTTP.

• AuthenticationNot required

  No account or session credentials are needed; the injection can be triggered by an unauthenticated request.

• Victim interactionNot required

  No victim action is required; the attacker sends a crafted request directly to the application without any user involvement.

• Attack complexityDetail

  Attack complexity is rated High, meaning exploitation is not condition-free; success depends on the presence of a usable PHP gadget chain within the application's loaded class context, which may require environmental enumeration.

Blast Radius

• Reads arbitrary files and sensitive data from the server, including WordPress configuration files containing database credentials.
• Writes or modifies files on the server file system, enabling webshell placement or theme/plugin file tampering.
• Executes arbitrary server-side code if a suitable gadget chain is available in the loaded PHP class context.
• Crashes or disrupts the WordPress application, causing denial of service for site visitors and administrators.