CVE-2026-40761: WordPress Valeska theme <= 1.2.2 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is an unauthenticated vulnerability in the WordPress Valeska theme by Edge-Themes, affecting all versions up to and including 1.2.2. An attacker can reach it over the network without any credentials, though exploitation requires specific conditions such as a suitable POP chain to be present in the environment. Successful exploitation can result in full confidentiality loss, data tampering, and service disruption. No upstream fix has been published yet; HarborGuard tracks this advisory and will make a patched-image rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable theme component is exposed over the network, so an attacker must be able to reach the WordPress installation via HTTP or HTTPS.

• AuthenticationNot required

  No account or credentials of any kind are needed; the injection point is reachable by any unauthenticated request.

• Victim interactionNot required

  The attack is fully server-side and requires no action from an administrator or site visitor.

• Attack complexityDetail

  Exploitation is rated High complexity, meaning the attacker must account for environmental factors such as the presence of a usable POP chain among installed plugins or themes to turn the injection into a meaningful exploit primitive.

Blast Radius

• A successful attacker can read any data the web server process can access, including WordPress database credentials, stored user session tokens, and site configuration files.
• The attacker can modify persisted data such as database rows, stored content, or configuration options by invoking object methods that perform write operations.
• The attacker can crash or render the WordPress service unavailable by triggering destructors or methods that exhaust resources or fatally error the PHP runtime.
• Because all three impact dimensions are rated High, the combined effect of a working exploit is effectively full compromise of the affected WordPress installation.