CVE-2026-40756

CVE-2026-40756 describes an unauthenticated PHP Object Injection in the WordPress Zoya theme (≤ 1.4). The underlying issue is in how PHP objects are handled in the theme, enabling crafted input to influence object deserialization. CVSS 3.1 base score 8.1 (HIGH) with network attack vector, high im...