CVE-2026-49107: WordPress Thrive Apprentice plugin < 10.8.10.2 - PHP Object Injection vulnerability

Synopsis

PHP Object Injection is a class of vulnerability where attacker-controlled serialized data is passed to PHP's unserialize() function, allowing the attacker to instantiate arbitrary PHP objects and chain them into destructive gadget sequences. The Thrive Apprentice WordPress plugin before version 10.8.10.2 exposes this vulnerability over the network with no authentication required, meaning any remote visitor can send a malicious payload without holding any account or credential on the site. Successful exploitation gives the attacker full read, write, and denial-of-service capability over the affected WordPress installation, up to and including remote code execution via available PHP gadget chains. A patched-image rebuild at version 10.8.10.2 is available on HarborGuard for environments running an affected version of Thrive Apprentice.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to send HTTP requests to the WordPress site over the network; no local or adjacent-network position is needed.

• AuthenticationNot required

  No account, session token, or credential of any kind is required; the vulnerable endpoint is reachable by any unauthenticated visitor.

• Victim interactionNot required

  The attacker sends the malicious serialized payload directly to the server; no user action or click is needed to trigger deserialization.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race condition, memory-layout dependency, or environmental prerequisite must be satisfied.

Blast Radius

• A successful attacker can read arbitrary files on the server, including wp-config.php, exposing database credentials, secret keys, and any secrets stored on the filesystem.
• The attacker can write or overwrite files on the server, enabling webshell installation or modification of WordPress core and plugin files.
• Via an available PHP gadget chain the attacker can achieve remote code execution, running arbitrary operating-system commands under the web server process account.
• The attacker can crash or exhaust server resources, taking the WordPress site offline and denying service to legitimate users.