CVE-2026-65579

Executive Summary

CVE-2026-65579 is a critical unauthenticated PHP Object Injection vulnerability affecting the WordPress Agricola theme, version 1.21.0 and earlier. This vulnerability allows remote, unauthenticated attackers to inject arbitrary PHP objects into the application, potentially leading to remote code execution, arbitrary file deletion, or data manipulation, depending on available gadget chains. The vulnerability carries a CVSS score of 9.8 (Critical) with full confidentiality, integrity, and availability impact. Any WordPress site running the Agricola theme at version 1.21.0 or below is affected. Patchstack has catalogued this vulnerability, and organizations should treat affected installations as actively exploitable and prioritize immediate remediation.

Technical Analysis

CVE-2026-65579 is a PHP Object Injection vulnerability classified under CWE-502 (Deserialization of Untrusted Data). The flaw exists in the WordPress Agricola theme, affecting all versions up to and including 1.21.0. The vulnerability is triggered through an unauthenticated attack vector, meaning that no authentication or prior access is required for exploitation.

The root cause of this vulnerability lies in the theme's handling of unserialized data. PHP Object Injection occurs when user-supplied input is passed to an unsafe unserialize() function call without proper sanitization or validation. When a malicious actor supplies a specially crafted serialized string, PHP deserializes it into an object of an arbitrary class. While the injection itself only creates objects, the attack becomes critical when the application's codebase contains classes with "magic methods" such as __wakeup(), __destruct(), __toString(), or __call(). These magic methods can trigger automatically during the deserialization process or when the object is destroyed, allowing the attacker to chain these behaviors into a "POP chain" (Property-Oriented Programming) that can achieve arbitrary file read, file write, remote code execution, or SQL injection.

The attack surface is the WordPress REST API or the theme's AJAX endpoints that process serialized parameters. Because the vulnerability is unauthenticated, the attacker does not need to create an account, log in, or possess any special privileges. The complexity of the attack is low (AC:L), and no user interaction is required (UI:N), making this a highly accessible entry point for widespread attacks.

The scope of the vulnerability is marked as "Unchanged" (S:U), meaning the compromise is confined to the software's security authority rather than extending to the underlying operating system or other components. However, the impact within that scope is severe: complete confidentiality breach (C:H) allowing data theft, complete integrity compromise (I:H) enabling content manipulation or malware injection, and complete availability loss (A:H) potentially leading to site defacement or denial of service.

It is important to note that as of this writing, no patch has been released for this vulnerability. Patch confidence is rated 0/4, indicating no evidence of a fix from any tracked source. The NVD description confirms the vulnerability exists in Agricola version 1.21.0 and earlier, and the absence of a "fixed in" version reference confirms the unpatched status. Exploit code availability is unknown, and no public PoC has been confirmed at the time of this report.

Exploitation Scenarios

Step 1: Reconnaissance and Target Identification

The attacker begins by scanning the internet for WordPress sites running the Agricola theme. Common discovery methods include:

• Using Shodan or Censys with search queries to identify WordPress installations
• Scanning for sites with the Agricola theme signature by examining the HTML source for theme-specific CSS or JavaScript file references (e.g., the theme directory path visible in page source)
• Using WordPress theme enumeration tools like wpscan with --enumerate vp (vulnerable plugins) or checking the theme version via the /wp-content/themes/agricola/style.css file, which typically contains version metadata, or possibly reading the changelog file if accessible
• Using google dorks like inurl:/wp-content/themes/agricola to locate candidate sites

Step 2: Crafting the Malicious Serialized Payload

The attacker identifies or constructs a gadget chain — a sequence of PHP classes present in the WordPress core, the Agricola theme, or common plugins — that includes a dangerous magic method. The attacker crafts a serialized PHP object string. For example, a generic payload might look like:

O:14:"Arbitrary_Class":1:{s:8:"property";s:100:"...malicious data...";}

The exact class name, property list, and trigger mechanism depend on the codebase of the targeted site. The payload is base64-encoded or URL-encoded to survive transport through HTTP requests.

Step 3: Delivery and Trigger

The attacker sends a crafted HTTP request containing the serialized payload as a parameter. Because the vulnerability is unauthenticated, this request can be sent via:

• A crafted GET request to a theme AJAX action endpoint, with a serialized parameter value embedded in the query string
• A crafted POST request with form data containing a serialized value
• A request to a WordPress REST API endpoint that passes the parameter to a vulnerable unserialize() call internally

Step 4: Deserialization and Payload Execution

When the theme processes the request, the malicious serialized string is passed to the unsafe unserialize() function. PHP deserializes the data, instantiating the object. During this process or shortly thereafter, a magic method fires. If the attacker has successfully chained objects, the following can occur:

• A __wakeup() or __destruct() method writes a web shell into the WordPress uploads directory (/wp-content/uploads/), creating a malicious PHP file
• A __toString() method triggers file read operations, exposing sensitive data like wp-config.php
• A custom chain triggers execution of operating system commands via functions like system() or exec() in a gadget class

Step 5: Post-Exploitation Activities

Once code execution or data access is achieved, the attacker can:

• Install a backdoor web shell for persistent access
• Exfiltrate the WordPress database (wp-config.php credentials, user tables, and password hashes)
• Deface the site or inject malicious iframes for drive-by malware distribution
• Use the compromised site as a spam relay or launchpad for further attacks against other infrastructure
• Leverage the site's legitimate reputation for phishing campaigns targeting the site's visitor base

Illustrative Attack Flow:

Attacker → HTTP Request (crafted serialized parameter) → unauthenticated endpoint
  → unserialize() (insecure) → PHP object instantiation → magic method triggered
  → file write / code execution → webshell deployed → full site compromise

Impact Assessment

The CVSS v3.1 score of 9.8 places this vulnerability in the Critical severity band (9.0-10.0). Breaking down the vector: AV:N (Network) means the attack can be performed remotely over the network with no physical or local access required; AC:L (Low) means the attack does not require special conditions and can be performed repeatedly with success; PR:N (None) means no privileges are required; and UI:N (None) means no user interaction is necessary.

The security impact subscores are all rated High:

• C:H (Confidentiality High): Complete disclosure of all information on the affected system, including the WordPress database, configuration files with database credentials, and any data processed by the site
• I:H (Integrity High): Complete compromise of data integrity, including the ability to modify core WordPress files, theme files, database contents, and inject malicious content
• A:H (Availability High): Complete loss of availability, allowing the attacker to delete all files, corrupt the database, or render the site unusable

Business Impact:

• Data Breach: Exposure of customer data, order information, and credentials if the WordPress site handles e-commerce or user registration
• Reputation Damage: Defacement or malware distribution from the site can erode customer trust and harm SEO rankings
• Command and Control Infrastructure: Compromised WordPress sites are frequently used in botnets or as C2 proxies
• Compliance Violations: GDPR, HIPAA, or PCI-DSS breaches may result in fines, penalties, and required breach notification procedures

Blast Radius: For a standard WordPress installation, the blast radius covers the entire web application environment, including any shared hosting configurations where adjacent sites on the same server could be accessible. On a single-tenant VPS or dedicated server, the compromise could theoretically extend to other applications on the same host, though the CVSS scope metric (Unchanged) indicates the primary compromise is contained to the WordPress instance. However, the realistic operational impact on the web property itself is total, affecting all pages, backend systems, and associated data.

Detection Guidance

Sigma Rule

title: CVE-2026-65579 - WordPress Agricola PHP Object Injection
id: c545ab0a-7f3b-4b2e-9dcc-1f8d5a2f3a01
status: experimental
description: Detects PHP object injection attempts against WordPress Agricola theme targeting unserialize endpoints in HTTP requests.
author: SOC Cyber Intelligence Team
date: 2026/02/15
logsource:
  category: webserver
  product: apache
detection:
  selection_base64:
    cs-method:
      - GET
      - POST
    cs-uri-query|contains:
      - 'serialize'
      - 'base64_decode'
      - 'O:'
  selection_encoding:
    cs-uri-query|contains|all:
      - '%4f%3a'
      - '%4F%3A'
  selection_ood_terms:
    cs-uri-query|contains:
      - 'application/x-php'
      - 'phar://'
  condition: selection_base64 and selection_ood_terms
falsepositives:
  - Legitimate PHP serialization in rare legitimate theme functionality
level: high
tags:
  - attack.t1190
  - cve.2026-65579
  - cwe.502

YARA Rule

rule WP_Agricola_PHP_Object_Injection_CVE_2026_65579
{
    meta:
        author = "SOC Cyber Intelligence Team"
        description = "Detects malicious serialized PHP object payloads targeting CVE-2026-65579"
        cve = "CVE-2026-65579"
        date = "2026-02-15"
        severity = "critical"
    strings:
        $serialized_php = /O:[0-9]+:"[^"]+":[0-9]+:\{/
        $urlencoded_o = "%4f%3a"
        $base64_o = "Tzo" ascii
        $magic_method = "__destruct" ascii
        $magic_wakeup = "__wakeup" ascii
        $phar_wrapper = "phar://" ascii
        $wp_upload_path = "wp-content/uploads" ascii nocase
    condition:
        uint16(0) == 0x0A0D or uint16(0) == 0x0A0A or filesize < 10MB and
        (1 of ($serialized_php, $urlencoded_o, $base64_o)) and
        (1 of ($magic_method, $magic_wakeup, $phar_wrapper)) and
        1 of ($wp_upload_path)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-65579 - WordPress Agricola PHP Object Injection Attempt"; flow:established,to_server; content:"GET"; http_method; content:"/wp-content/themes/agricola/"; http_uri; nocase; pcre:"/(%4[Oo]%3a|O%3A|O:)[0-9]+:\x22/i"; content:"serialize"; http_uri; nocase; reference:cve,2026-65579; classtype:attempted-admin; sid:202665579; rev:1; metadata:created_at 2026_02_15, updated_at 2026_02_15;)

Elastic Detection

sequence by source.ip, destination.ip with maxspan=5m
  [network where network.protocol == "http"
   and process.name != null and
   url.path : "*wp-content*" and
   url.path : "*agricola*" and
   url.query contains "serialize" or
   url.query contains "%4f%3a" or
   url.query contains "O%3a" or
   url.query contains "O:"
  ]

or alternatively:

any where network.protocol == "http" and
  (url.path : "*agricola*" and
   (query contains "O:" or query contains "%4f%3a" or query contains "base64"))

Splunk SPL Query

index=web sourcetype=access_combined
| where like(uri_path, "%/wp-content/%") 
| where like(uri_path, "%agricola%")
| search uri_query="*O:*" OR uri_query="*%4f%3a*" OR uri_query="*serialize*" OR uri_query="*base64*"
| eval attack_indicator = case(
    lower(uri_query) LIKE "%__destruct%", "PHP Object Injection: __destruct",
    lower(uri_query) LIKE "%__wakeup%", "PHP Object Injection: __wakeup",
    lower(uri_query) LIKE "%phar://%", "PHP Phar deserialization",
    1=1, "Potential PHP Object Injection"
  )
| stats count by src_ip, uri_path, attack_indicator, status
| where status=200 OR status=404
| sort - count
| table _time, src_ip, dst_ip, uri_query, attack_indicator, status, count

Wazuh OSSEC Rule

<group name="wordpress,">
  <rule id="100655" level="14">
    <decodedata>apache-access</decodedata>
    <field name="url" type="pcre2">(?i)(/wp-content/themes/agricola/)</field>
    <field name="url" type="pcre2">(%4f%3a|O%3A|O:).*?(__destruct|__wakeup|phar)</field>
    <description>WordPress Agricola theme PHP object injection attempt detected (CVE-2026-65579).</description>
    <group>attack.t1190,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
    <info type="cve">CVE-2026-65579</info>
    <info type="cwe">CWE-502</info>
  </rule>
</group>

Note: The Wazuh rule requires the Apache access log decoder to be active and the "url" field to be extracted from the log entry. Adjust field names according to your specific log source configuration.

Mitigation & Patch Guidance

Patch Confidence Level: 0/4 (UNPATCHED) — As of the writing of this report, no patch exists for CVE-2026-65579. The vendor has not released an updated version of the Agricola theme, and no advisory indicating a timeframe for resolution is currently available.

Immediate Mitigations (without a patch):

1. Disable the Agricola theme immediately. Replace it with a bundled default WordPress theme (e.g., Twenty Twenty-Five or the current default) or a known-secure third-party theme. This removes the vulnerable code path from execution entirely.
2. Block access to vulnerable endpoints at the WAF level. Apply a Web Application Firewall rule that filters requests containing serialized PHP object patterns in query strings or POST data. Deploy the Sigma/Suricata detections listed above to block or flag traffic matching the object injection signatures.
3. Monitor access logs aggressively. Implement the Splunk and Elastic queries to identify existing exploitation attempts. Review historical logs for previous suspicious patterns that may indicate prior compromise.
4. Restrict access to wp-admin and wp-login.php with IP allowlisting or additional authentication factors to reduce the attack surface should other vulnerabilities be present.
5. Take a full backup of the site files and database, so that remediation can be performed quickly if an active compromise is detected.

Patch/Upgrade Steps:

1. Monitor Patchstack and the theme vendor's official website for the release of a patched version of Agricola (1.21.1 or later).
2. Before patching, review the changelog to confirm the fix addresses the unserialize vulnerability.
3. When a patched version is available, update immediately through the WordPress admin dashboard by navigating to Appearance → Themes → Update, or by downloading and replacing the theme files via FTP/SFTP.
4. After updating, reverify the vulnerability by re-scanning the site with vulnerability scanners to confirm the exposure has been resolved.

Long-Term Hardening:

1. Remove unused themes and plugins from the WordPress installation. Having only the active theme installed reduces the attack surface and eliminates the possibility of vulnerable unused code being invoked.
2. Subscribe to security advisories from Patchstack and the WordPress security ecosystem to receive immediate notifications about new vulnerabilities in your theme and plugin inventory.
3. Implement a WordPress hardening baseline that includes:
   • Disabling file editing through the dashboard (DISALLOW_FILE_EDIT constant)
   • Enforcing strong authentication methods (including 2FA for admin accounts)
   • Implementing a scheduled backup strategy
   • Keeping PHP updated to the latest stable version supported by the site
4. Review all code that handles user-supplied input for unsafe use of unserialize(). Replace risky patterns with json_decode() or implement strict allow-lists of permitted classes when deserialization is required.
5. Implement a WAF and monitoring service (e.g., Cloudflare, Sucuri, or ModSecurity) with default WordPress hardening rules to provide an additional layer of defense against zero-day vulnerabilities of this class.

Vendor Communication: Since no patch is currently available, affected site owners should contact the theme vendor directly to request a status update on remediation plans. If the vendor is unresponsive, consider substituting the theme permanently, as prolonged exposure to a critical unauthenticated RCE-level vulnerability is not operationally acceptable.

References

1. NVD Entry for CVE-2026-65579: https://nvd.nist.gov/vuln/detail/CVE-2026-65579 — Official National Vulnerability Database entry containing the CVE description, CVSS v3.1 vector and score, CWE-502 classification, and reference links.
2. Patchstack Database (Vulnerability for Agricola ≤ 1.21.0): https://patchstack.com/database/ — Patchstack, the CNA that published this vulnerability, maintains the full advisory including affected version data and disclosure timeline.
3. CWE-502 — Deserialization of Untrusted Data: https://cwe.mitre.org/data/definitions/502.html — Official MITRE Common Weakness Enumeration entry explaining the class of vulnerability that enables PHP Object Injection attacks.
4. OWASP Deserialization Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Deserialization_Cheat_Sheet.html — OWASP guidance on detecting and mitigating unsafe deserialization, applicable to PHP object injection scenarios like this CVE.
5. MITRE ATT&CK — T1190: Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/ — Reference for the primary MITRE ATT&CK technique associated with remote exploitation of this vulnerability.

Threat Actor Activity / Exploit-in-the-Wild Status: As of this report, there are no confirmed reports of CVE-2026-65579 being exploited in active campaigns, and no public exploit code has been disclosed. However, given the criticality score (9.8), the unauthenticated attack vector, and the widespread use of WordPress themes across the internet, active exploitation is considered highly likely to emerge rapidly. The CVE has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog at the time of writing, and the EPSS score has not yet been published by FIRST.org. Security teams are strongly advised to treat this as an actively dangerous vulnerability and prioritize the mitigations outlined above.