Executive brief
NeoBeat, a WordPress theme used for building websites, contains a security flaw that allows unauthorized individuals to inject malicious code. If exploited, an attacker could potentially take full control of the website, steal sensitive customer data, or cause the site to crash. This vulnerability is particularly dangerous because it does not require a password to exploit and is often targeted in automated mass-attacks.
Technical details
The NeoBeat theme for WordPress is vulnerable to PHP Object Injection in versions up to and including 1.7. This issue arises from the deserialization of untrusted data (CWE-502), allowing an unauthenticated attacker to inject PHP objects. If a suitable Property-Oriented Programming (POP) chain is present in the environment, this can lead to remote code execution, SQL injection, or arbitrary file deletion. The attack can be performed over the network without any user interaction or prior authentication. Users are advised to update to version 1.8 or later to remediate the vulnerability.
Affected products
- Elated-Themes NeoBeat <= 1.7
Timeline
- 2026-02-12: other: Reported by Denver Jackson
- 2026-04-08: advisory: Patchstack advisory published
- 2026-06-17: disclosed: NVD publication date