Is CVE-2026-40756 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40756 being exploited in the wild.

How severe is CVE-2026-40756?

High severity, with a CVSS score of 8.1, published 17 June 2026.

Is there a fix for CVE-2026-40756?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40756 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-40756?

Check whether you run Mikado-Themes Zoya at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40756: Mikado-Themes Zoya PHP Object Injection

CVE-2026-40756 · Severity: high · CVSS 8.1 · Published 2026-06-17

The Zoya theme for WordPress is vulnerable to a security flaw that allows unauthorized users to inject malicious code. This could lead to a complete takeover of the website, theft of customer data, or disruption of services. Business owners using this theme should update to version 1.5 immediately to prevent potential automated attacks.

Vendors: Mikado-Themes.

Quick answers

Is CVE-2026-40756 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40756 being exploited in the wild.
How severe is CVE-2026-40756?: High severity, with a CVSS score of 8.1, published 17 June 2026.
Which products and versions are affected?: Mikado-Themes Zoya <= 1.4.
Is there a fix for CVE-2026-40756?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40756 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-40756?: Check whether you run Mikado-Themes Zoya at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Zoya theme for WordPress (versions <= 1.4) is vulnerable to PHP Object Injection via the deserialization of untrusted data (CWE-502). An unauthenticated remote attacker can exploit this vulnerability by submitting specially crafted input to the application. If a suitable Property-Oriented Programming (POP) chain is present within the environment, the attacker could achieve remote code execution, perform SQL injection, or conduct path traversal. The vulnerability is addressed in version 1.5.

Affected products

Mikado-Themes Zoya <= 1.4

Timeline

2026-02-24: other: Vulnerability reported by Denver Jackson
2026-04-20: disclosed: Initial disclosure by Patchstack
2026-06-17: advisory: CVE published and NVD record created

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.