CVE-2026-40758: WordPress Léonie theme <= 1.2.1 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability in the Léonie WordPress theme (versions 1.2.1 and earlier) where attacker-controlled input is passed to PHP's unserialization routines without validation. The flaw is reachable over the network and requires no authentication, though successful exploitation depends on environmental conditions such as the presence of a suitable PHP property-oriented programming (POP) chain in the loaded codebase. When exploited, an attacker gains the ability to read sensitive data, tamper with stored content, or crash the affected service, and in many environments a full remote code execution primitive is achievable. No upstream fix has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker can reach it from the internet or any routable path to the WordPress installation without needing internal access.

• AuthenticationNot required

  No account or session credential is needed; the attacker can trigger unserialization as an anonymous, unauthenticated HTTP request.

• Victim interactionNot required

  Exploitation is fully server-side and does not require any action from an administrator or other user of the site.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning success depends on environmental factors such as the availability of a suitable POP chain among the PHP classes loaded by the application, which may require reconnaissance or specific plugin combinations.

Blast Radius

• Reads arbitrary files on the server, including WordPress configuration files that contain database credentials and secret keys.
• Modifies or deletes database rows and stored content if the POP chain supports write operations.
• Crashes the PHP process or the web server worker handling the request, causing service disruption for site visitors.
• In environments where a full POP chain is available, executes arbitrary operating system commands as the web server user, giving the attacker a persistent foothold on the host.