CVE-2026-40760: WordPress Behold theme <= 1.5 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is an unauthenticated remote code execution class of vulnerability affecting the Behold WordPress theme by Edge-Themes, versions 1.5 and below. The flaw is reachable over the network without any credentials, though exploitation requires meeting certain environmental conditions (such as a suitable POP chain being present). Successful exploitation gives an attacker full control over confidentiality, integrity, and availability of the affected host. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to send HTTP requests to the WordPress installation.

• AuthenticationNot required

  No account or session credentials of any kind are needed to trigger the injection.

• Victim interactionNot required

  The attack is entirely server-side; no user action or social engineering is required.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must account for environmental factors such as the presence of a usable POP chain (a sequence of existing PHP classes that can be weaponized) within the application.

Blast Radius

• A successful attacker can read any file readable by the web server process, including WordPress configuration files that contain database credentials and secret keys.
• An attacker can write or modify files on the host, enabling persistent backdoor installation or defacement of site content.
• Arbitrary PHP code execution is achievable if a suitable POP chain exists, giving the attacker full operating-system-level command execution within the container.
• The web server process can be crashed or resource-exhausted, causing a denial of service for the hosted site.