Description
Unauthenticated PHP Object Injection in Zoya <= 1.4 versions.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Mikado-Themes | Zoya | ≤ 1.4 | — |
High · 8.1
CVE-2026-40756
EUVD-2026-37696GHSA-9qfq-rw3c-8x7p
WordPress Zoya theme <= 1.4 - PHP Object Injection vulnerability
Published Jun 17, 2026 · Updated Jun 17, 2026 · Assigned by Patchstack