Unauthenticated PHP Object Injection in FreightCo

Executive Summary

CVE-2026-66650 is an unauthenticated PHP Object Injection vulnerability in the FreightCo WordPress theme versions 1.1.15 and below. This flaw allows attackers to inject malicious PHP objects without needing prior access, potentially leading to code execution, SQL injection, or other attacks if a suitable POP chain exists.

Useful 0 Not Useful 0

Detection Guidance

Since this is a PHP Object Injection vulnerability in the FreightCo WordPress theme, detection involves checking for vulnerable versions (1.1.15 or below) and monitoring for suspicious activity. Use commands like 'grep -r "FreightCo" /var/www/html/wp-content/themes/' to locate the theme and verify its version. Check web server logs for unusual POST requests or error logs indicating PHP object injection attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute arbitrary code, manipulate databases, access sensitive files, or disrupt services on your website. Since it is unauthenticated, anyone can exploit it remotely, making it highly dangerous for unpatched sites. Mass-exploit campaigns targeting thousands of websites are expected.

Useful 0 Not Useful 0

Compliance Impact

Exploitation could lead to data breaches, unauthorized access to personal or health data, or system disruptions, violating GDPR and HIPAA requirements for data protection and security. Non-compliance may result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately apply Patchstack's mitigation rule to block attacks. If possible, update the FreightCo theme to a patched version. If no patch exists, consider temporarily disabling the theme or replacing it with an alternative. Contact your hosting provider or a web developer for assistance. Monitor logs for exploitation attempts and restrict access to admin interfaces.

Useful 0 Not Useful 0