CVE-2026-42380: WordPress AI Lab theme < 5.4.2 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a vulnerability in the AI Lab WordPress theme (versions below 5.4.2) by jwsthemes. The flaw is reachable over the network with no authentication required, and the CVSS vector indicates no user interaction is needed to trigger it. Successful exploitation gives an attacker full read, write, and denial-of-service capability against the affected system. A patched-image rebuild at version 5.4.2 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, meaning an attacker can reach it from the internet without any prior foothold on the host.

• AuthenticationNot required

  No account or session credential of any privilege level is needed to trigger the injection.

• Victim interactionNot required

  The attacker does not need to trick or wait for any user to take an action; the exploit is entirely attacker-driven.

• Attack complexityDetail

  Exploitation is reliable and condition-free, with no race conditions or special environmental setup required.

Blast Radius

• A successful attacker can read any data the web process can access, including stored credentials, session tokens, and site configuration secrets.
• The attacker can write or modify persisted data, including database records, theme files, and uploaded content.
• The attacker can crash or hang the affected service, making the site unavailable to legitimate users.
• Because all three impact dimensions (confidentiality, integrity, availability) are rated High, a single successful exploit can fully compromise the affected WordPress installation.