CVE-2026-40759: WordPress Esmée theme <= 1.4 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a class of vulnerability where attacker-controlled data is passed to PHP's unserialize() function, tricking the application into instantiating arbitrary objects and executing unintended code paths. This vulnerability in the WordPress Esmée theme (versions 1.4 and earlier) is reachable over the network with no authentication required, and exploitation is subject to environmental conditions that affect reliability. Successful exploitation gives an attacker full read, write, and availability impact on the affected host. No fix has been published; HarborGuard tracks the upstream advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker must be able to reach the WordPress installation via HTTP/HTTPS from a remote location.

• AuthenticationNot required

  No account or session credentials are needed; the injection point is accessible to unauthenticated requests.

• Victim interactionNot required

  Exploitation is entirely attacker-driven and does not require any action from a logged-in user or administrator.

• Attack complexityDetail

  Attack complexity is rated High, meaning reliable exploitation depends on environmental factors such as the presence of a suitable POP chain (a sequence of existing PHP classes) within the WordPress installation's loaded codebase.

Blast Radius

• A successful attacker reads arbitrary files from the server, including WordPress configuration files containing database credentials and secret keys.
• A successful attacker writes or modifies files on the server, enabling persistent backdoor placement or defacement of site content.
• A successful attacker can crash or destabilize the PHP process or underlying service, causing denial of service for the hosted WordPress site.
• Where a suitable POP chain exists in loaded plugins or themes, the attacker executes arbitrary operating-system commands on the container host.