Unauthenticated remote code execution affects Floci versions 1.1.0 through releases prior to 2.2.0, where the API Gateway VTL template engine fails to sandbox Velocity template rendering. An attacker who can reach the Floci control plane can define a REST API with a MOCK integration whose mapping template uses $util reflection to reach Runtime or ProcessBuilder, executing arbitrary OS commands inside the Floci JVM - a CVSS 9.3 (CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) impact confirmed as unauthenticated by the PR:N vector. Publicly available exploit code exists, though no public exploit identified at time of analysis as confirmed actively exploited (CISA KEV), and a vendor-released fix is available in Floci 2.2.0. Because Floci is primarily a local and CI developer emulator of AWS services, practical exposure depends heavily on whether its API Gateway/AppSync endpoints are bound beyond localhost.
Privilege escalation in JeecgBoot through 3.9.5 lets any authenticated user approve their own pending tenant administrator application and obtain tenant-admin ('tenant pack') permissions across any tenant. The SysTenantController passApply handler performs no authorization check, so a low-privilege account can file an application via doApplyTenantPackUser and then approve it with a PUT to /sys/tenant/passApply, reaching high confidentiality and integrity impact without user interaction or elevated privileges (assessed CVSS 3.1 8.1, PR:L). Publicly available exploit code exists - a Python proof-of-concept for tenant ownership and pack approval is published on GitHub and referenced by VulnCheck - but no CISA KEV entry has been reported, so confirmed active exploitation cannot be asserted.
Missing authorization in the saveDeptRolePermission endpoint of JeecgBoot's SysDepartPermissionController lets any authenticated user - regardless of privilege level - rewrite department role permissions, granting themselves arbitrary menu and button permissions or stripping permissions from other accounts. The flaw affects JeecgBoot through 3.9.5 and requires only a valid low-privilege session (PR:L in the CVSS vector), with no user interaction and no special configuration; publicly available exploit code exists, though there is no confirmation of active exploitation in the wild. The independent assessment rates this a genuine, actionable priority: the sole realistic barrier for an attacker is obtaining one low-privilege credential, so internet-exposed instances that permit self-registration are at direct risk.
Unauthenticated remote attackers can exhaust memory and CPU in SillyTavern 1.12.13 through 1.19.0 by sending large or compressed JSON or urlencoded request bodies, because the body-parser middleware processes request bodies before authentication and whitelist checks. Publicly available exploit code exists, and the vendor CVSS 4.0 vector rates this as a network-reachable, unauthenticated flaw (base 8.2); our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms no authentication or special toggle is required, but notes that realistic exploitation requires the operator to have exposed the instance to untrusted networks. Default configurations are affected, though SillyTavern is typically run as a local single-user service bound to localhost or a trusted LAN.
Command execution in Spotweb through 1.5.8 can be triggered through the optional runcommand NZB handler when malicious Usenet spots carry shell metacharacters in their titles; a Spotweb user then has to download the spot so the unescaped title is substituted into $SPOTTITLE and passed to exec(). Exploitation does not require Spotweb authentication, but it is conditional on the runcommand handler being enabled and on passive victim interaction, and code runs with the privileges of the Spotweb PHP process. Publicly available exploit code exists, though no CISA KEV active exploitation is reported; instances without the runcommand integration are not exposed through this path.
Unauthenticated arbitrary file read affects the Divi Plus plugin for WordPress through version 2.4.0, letting any remote attacker retrieve files from the web server via the svg_image parameter of the /wp-json/elicus/v1/dipl-modules/svg-animator REST endpoint. The endpoint's permission callback returns true unconditionally and the input checks used (sanitize_text_field() and esc_html()) do not block filesystem paths, the file:// stream wrapper, or arbitrary URLs, so the raw contents of the targeted file are returned in the JSON 'html' field; the issue is rated CVSS 3.1 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). No public exploit code has been identified at time of analysis, and no EPSS score or CISA KEV listing was provided, but successful reads of sensitive files such as wp-config.php could enable follow-on remote code execution.
JeecgBoot through 3.9.5 ships a system log controller whose batch-delete handler performs no authorization check, so any authenticated user - including the lowest-privileged account - can send a DELETE request with the ids parameter set to the special value 'allclear' and wipe the entire sys_log audit table for every user. The result is silent, organization-wide destruction of audit trail evidence rather than data theft, code execution, or privilege escalation, which keeps the real-world impact bounded. Publicly available exploit code exists (a Python PoC script referenced by VulnCheck), and CISA KEV does not list this CVE as confirmed actively exploited (CISA KEV); the vulnerability is confirmed exploited only in the reported PoC sense, not in observed campaigns. CVSS scores of 7.1 (vendor v4.0 and our assessed v3.1) reflect high integrity impact on the log table with low availability impact and no confidentiality impact.
Database credential disclosure in JeecgBoot through 3.9.5 allows any authenticated low-privileged user to retrieve JDBC connection URLs, database usernames, and decrypted cleartext database passwords from the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiController. The handler carries no Shiro permission or role annotations, so a basic application account is sufficient; the only practical hurdles are obtaining any valid session and knowing or enumerating a valid dbSourceCode value, and exposure requires that dynamic datasources be configured on the instance. Publicly available exploit code exists, and the impact is confidentiality-only (CVSS 3.1 6.5 / CVSS 4.0 7.1, PR:L), with no evidence of confirmed active exploitation at time of analysis.
Missing authorization in JeecgBoot through 3.9.5 lets any authenticated user enumerate record IDs through the unguarded /airag/app/queryById endpoint and then read MCP (Model Context Protocol) server configurations - including endpoint URLs, HTTP headers and outbound authentication tokens - because the permission check in AiragMcpController.queryById is commented out. Exploitation requires a valid JeecgBoot session at any privilege level (CVSS v4.0 PR:L, assessed CVSS 3.1 PR:L) and a deployment that actually uses the AiRAG/MCP feature with stored MCP records; a stock install without configured MCP servers exposes nothing sensitive. Publicly available exploit code exists, though the issue is a moderate-priority information-disclosure flaw (high confidentiality impact, no integrity or availability impact) rather than a remote-takeover bug, and no CISA KEV entry indicates confirmed active exploitation.
Information disclosure in Open Source Social Network (OSSN) through 10.1 allows authenticated users to read other users' private message attachments by requesting the /messages/attachment/{guid} route with sequential or guessed file GUIDs. The flaw is an insecure direct object reference (CWE-639) in the default attachment handler, which outputs a file whenever it is typed as a message attachment without verifying that the requesting user is the sender or recipient; no user interaction is required, but a valid low-privileged account and a valid attachment GUID are needed. Publicly available exploit code exists (a HackMD writeup), and a vendor-linked fix commit is referenced, though a released patched version is not independently confirmed, and there is no indication of confirmed active exploitation (CISA KEV).
Authenticated low-privileged users of JeecgBoot through 3.9.5 can retrieve any other user's stored password ciphertext through the GET /sys/api/getUserByName endpoint, which lacks authorization checks. Because the platform exposes its hard-coded AES-CBC encryption key via /sys/getEncryptedString, an attacker holding only a basic account can decrypt the returned password values locally and then subject administrator credentials to offline guessing. Publicly available exploit code exists, and exploitation requires a valid low-privileged account (PR:L) with network reachability, making this a genuine but moderate-priority credential-disclosure issue rather than an unauthenticated critical flaw; no CISA KEV entry indicates confirmed active exploitation at time of analysis.
Tenant ownership takeover in JeecgBoot through 3.9.5 lets any authenticated user - regardless of privilege level - reassign a tenant's owner by sending userId and tenantId to POST /sys/tenant/changeOwenUserTenant, stripping the legitimate owner and potentially installing the attacker or an accomplice as the new owner. The root cause is a missing authorization check (CWE-862) on the multi-tenant owner-change handler, rated CVSS 7.1 (CVSS:4.0 PR:L, UI:N, integrity-only impact), and publicly available exploit code exists. Exploitation is not drive-by: it requires a valid account on the target and a deployment where the multi-tenant feature is enabled, making this an access-control-bounded integrity risk rather than anonymous remote compromise.
Unauthenticated remote code execution in the WordPress plugin SiteVault - Backup, Restore, Migration & Cloning (royal_plugins) at version 1.5.19 and earlier lets any remote attacker run arbitrary PHP code on an affected site with no login, no special configuration, and no user interaction, yielding CVSS 10.0 / 9.8-class impact. Any WordPress installation with this plugin installed and active is exposed; sites that never installed it, or that have upgraded past 1.5.19, are unaffected. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the low complexity and zero prerequisites make this a genuine high-priority issue rather than a CVSS-inflated paper risk, and full site compromise (including database and backup archives) is the realistic outcome of exploitation.
Authenticated arbitrary file upload in the CodeBard Help Desk WordPress plugin (versions up to and including 1.1.2) lets any logged-in user holding only a subscriber-level account push an executable PHP file onto the server through the plugin's ticket/attachment upload path, which typically converts into full remote code execution on the WordPress host. The flaw is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - the scope change reflects that a low-privileged plugin user can compromise the whole site, not just the plugin - and requires no administrator rights and no victim interaction, though it does require an account on the target site (trivially obtained wherever open or self-service registration is enabled). At time of analysis there is no CISA KEV entry and no public exploit code identified for this issue; the practical urgency therefore turns on how easily an attacker can register a subscriber account on the target installation. This is a genuine high-priority issue, not a CVSS-inflated one.
Arbitrary file upload in the WordPress plugin Creator LMS (by WPFunnels) versions 1.2.21 and earlier lets an authenticated user holding only Contributor-level privileges upload a file of an attacker-chosen type to the web server, which can be leveraged to drop and execute server-side code on the host. The vulnerability is rated Critical (CVSS 3.1 base 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting no user interaction and no administrative access requirement once a Contributor account exists, with scope change indicating impact beyond the plugin itself to the underlying site. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, though the low privilege bar and the open-registration patterns common on LMS sites make this a high-priority item for any WordPress installation running this plugin.
Unauthenticated remote code execution affects Expivi 3D Product Configurator for WooCommerce through version 2.16.2. Missing authentication and nonce checks on the wp_loaded handler, combined with unsanitized xpv_image POST input echoed into a Dompdf-rendered .phtml template with PHP execution enabled, lets any remote attacker execute code on the server. No public exploit identified at time of analysis; CVSS 9.8 and CWE-434 indicate critical, unauthenticated risk.
Unauthenticated arbitrary file upload in the WordPress plugin Extensions For CF7 (Contact Form 7 Database, Conditional Fields and Redirection) versions up to and including 3.4.5 allows remote attackers to write attacker-controlled files into the site's upload directory through the plugin's signature field, with remote code execution as the likely outcome. The flaw is reachable via the extcf7_submit function without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) but only on sites that have a Contact Form 7 form actually using the plugin's signature field; sites not exposing that field are not reachable through this vector. At time of analysis no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), and the vendor has released a fix in version 3.4.6, so the exposure window is bounded by how quickly affected sites update.
PHP object injection in the Dynamic User Directory WordPress plugin (versions 2.4 and earlier) allows an attacker holding a low-privileged account to feed attacker-controlled serialized data into an unserialize() call, potentially enabling arbitrary file operations, data disclosure, or remote code execution if a usable POP gadget chain exists within the plugin, WordPress core, or a co-installed plugin. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N), but our independent assessment lowers the privileges-required metric to Low (PR:L) because the Patchstack 'Subscriber' designation means the attacker must already hold a subscriber-level WordPress account; sites that disable open user registration substantially limit exposure. No public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in the miniOrange OTP Verification WordPress plugin through 5.5.7 allows an attacker to gain elevated privileges on affected sites; the supplied CVSS 3.1 vector scores it 9.8 Critical (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), describing a remote, unauthenticated, low-complexity flaw, though the incorrect privilege assignment (CWE-266) may in practice require a low-privileged authenticated account and authentication requirements are not confirmed from available data. No public exploit code or active exploitation (CISA KEV) is identified in the provided intelligence.
Unauthenticated attackers can bypass two-factor authentication and obtain a fully authenticated session for any 2FA-enabled account - including administrators - on WordPress sites running the Advanced IP Blocker plugin through version 8.13.13, without ever supplying a password. The plugin's step-2 handler fails to verify that step-1 password authentication was completed and leaks reusable interim and verify nonces to any unauthenticated caller, while the 6-digit TOTP comparison has no attempt counter, no account lockout, and does not fire wp_login_failed, so an attacker can brute-force up to roughly 10^6 codes for a known user_id and receive a session cookie via wp_set_auth_cookie, resulting in complete site takeover. No public exploit identified at time of analysis, and exploitation requires only that the targeted account has the plugin's own 2FA feature enabled and that the attacker knows its user_id (administrator accounts are commonly user_id 1).
Privilege escalation in the AIWU WordPress plugin (ai-copilot-content-generator) through version 1.5.9 lets a low-privileged Subscriber account elevate itself to a higher role, up to administrator, by abusing incorrect privilege assignment (CWE-266) in the plugin. Sites are fully exposed when the WordPress 'Anyone can register' option is enabled, since an attacker can self-provision the required Subscriber account; where registration is closed, the attacker must already hold or be granted such an account. Our independent assessment scores this as CVSS 9.8 with PR:L (Subscriber required), which conflicts with the supplied PR:N vector, so the unauthenticated framing should be verified against the Patchstack advisory; no public exploit identified at time of analysis, and no confirmed active exploitation (no CISA KEV listing).
Authentication bypass in the WPCOM Member WordPress plugin (all versions up to and including 1.7.27) allows remote, unauthenticated attackers to establish a fully authenticated WordPress session as any user, including administrators, by forging a session entry that the plugin's social-login callback later resolves to a victim's bound social identifier. The published CVSS is 9.8, but independent assessment rates it AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H: exploitation is gated by two real-world prerequisites - the target must have at least one social login provider configured (which is what registers the vulnerable callback on the WordPress init hook), and the attacker must know or be able to enumerate the victim account's bound openid/unionid, with admin takeover specifically requiring the administrator's identifier. Cross-referenced sources show no CISA KEV entry and no public exploit code identified at time of analysis, so the practical risk is best characterized as a genuine high-priority issue whose severity is tempered by the non-universal configuration requirement and the prior-knowledge hurdle rather than a universally exploitable 9.8.
Attackers can delete arbitrary files outside the intended directory in rtMedia for WordPress, BuddyPress and bbPress (buddypress-media) versions up to 4.7.13 due to a path traversal flaw, causing high integrity and availability impact. The published CVSS score is 9.8, but our assessment indicates a likely authenticated vector (PR:L) and no confidentiality impact; authentication requirements are not confirmed from available data. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated PHP object injection in the ThemeRex WineShop WordPress theme (all versions up to and including 3.20) lets remote attackers push attacker-controlled serialized data into a PHP unserialize() operation, enabling instantiation of arbitrary PHP objects and - where a usable gadget chain exists in the theme, co-installed plugins, or the runtime - remote code execution, arbitrary file read/write, or SQL injection. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), meaning exploitation against a default installation requires no authentication and no user interaction, per the published PR:N/UI:N vector. At time of analysis there is no public exploit code identified and the theme is not listed in CISA KEV; practical exposure is limited to sites actually running this niche wine-shop theme and by whether an exploitable POP gadget chain is reachable.
Unauthenticated PHP object injection in the ThemeRex Equadio WordPress theme (versions up to and including 1.1.4) allows remote attackers to supply crafted serialized input to vulnerable deserialization entry points, potentially leading to remote code execution, file deletion, or other high-impact outcomes depending on available gadget chains. The flaw carries a CVSS 3.1 base score of 9.8, reflecting network exploitability with low complexity, no authentication, and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, though the severity and ease of exploitation make prompt patching critical.
Unauthenticated PHP Object Injection in the ThemeRex 'Juno' WordPress theme affects all versions up to and including 2.25, allowing remote attackers to supply a crafted serialized PHP object that the theme deserializes without validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates this as a network-reachable, low-complexity flaw requiring no credentials and no user interaction, with high confidentiality, integrity and availability impact; however, real-world impact depends on whether a usable POP gadget chain exists in the theme or in co-installed plugins, which is not confirmed in the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis (Patchstack is credited as the reporting source), and exploitation is limited to the subset of WordPress sites running this specific commercial theme at an affected version.
Unauthenticated PHP object injection in the BoldThemes Avala WordPress theme at version 1.1.4 and earlier lets remote attackers pass attacker-controlled data into PHP's unserialize() through a publicly reachable code path, with no authentication or user interaction required (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Real-world impact - remote code execution, arbitrary file read/write/delete, or SQL injection - depends on the presence of a usable POP/gadget chain in the theme itself, WordPress core, or another installed plugin; without such a chain the injection may be inert, so the 9.8 score represents a worst-case profile rather than a guaranteed outcome. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation requires the Avala theme to be installed and active at version 1.1.4 or below.
Unauthenticated PHP object injection in the Kalles WordPress theme (versions up to and including 1.1.7.1) allows a remote attacker to pass crafted serialized data into a PHP unserialize() call, which on a site that loads a usable gadget chain can escalate to full compromise of the WordPress installation - sensitive data theft, arbitrary content or code modification, and denial of service. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity flaw requiring no credentials and no user interaction, consistent with the CWE-502 classification, and no public exploit has been identified at time of analysis. Real-world impact is bounded by gadget availability in the surrounding WordPress core, plugins, and bundled libraries, so not every installation will reach the full high-confidentiality/integrity/availability outcome.
Unauthenticated PHP object injection in the ThemeRex 'Yacht Rental' WordPress theme affects all versions up to and including 2.6, allowing a remote attacker to pass crafted serialized data into a PHP deserialization path without credentials or user interaction. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the theoretical worst case is high confidentiality, integrity, and availability impact with a 9.8 base score. No public exploit code has been identified at time of analysis, and the practical severity depends on whether a usable PHP gadget chain exists within the theme, WordPress core, or co-installed plugins - without such a gadget, real-world impact may be reduced.
Unauthenticated PHP Object Injection in the Wine House WordPress theme (version 3.20 and earlier, distributed by ThemeREX) allows a remote attacker to deliver a crafted serialized payload to an unserialize() call, which the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates at 9.8 Critical with full Confidentiality, Integrity, and Availability impact. Because PR:N and UI:N are confirmed by the vector, no authentication or victim interaction is required - any unauthenticated request to the affected endpoint against a site with the theme installed and active can carry the payload. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical severity is bounded by whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins; absent such a gadget, impact may degrade to denial of service or be non-exploitable, and the target population is limited to sites running this single commercial theme.
Unauthenticated PHP object injection in the ThemeREX Tipsy WordPress theme through version 1.6 allows remote attackers to supply crafted serialized data that the theme passes to PHP unserialize(), potentially leading to remote code execution, file manipulation, or SQL injection where a usable POP gadget chain exists. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the flaw is network-reachable, low-complexity, and requires neither authentication nor user interaction, with full confidentiality, integrity, and availability impact (9.8). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation is constrained by the need for an exploitable gadget chain in the theme, WordPress core, or an active plugin.
Unauthenticated PHP object injection in the Stargaze WordPress theme (versions 1.10 and earlier) allows remote attackers to submit a crafted serialized payload that the theme feeds to PHP's unserialize(), which can trigger arbitrary object instantiation and, where a usable gadget chain is present, code execution or full site compromise; the maximum-base CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact. Per that vector no authentication (PR:N) and no user interaction (UI:N) are required, and the CPE record cpe:2.3:a:themerex:stargaze ties the exposure to the ThemeREX Stargaze theme, so only sites with this theme installed and active are in scope. At time of analysis there is no public exploit identified, and the practical ceiling on impact depends on whether a viable POP gadget chain exists in the theme itself, a co-installed plugin, or WordPress core.
Unauthenticated PHP object injection in the ThemeRex Splendour WordPress theme (versions 1.23 and earlier) lets remote attackers pass crafted serialized data into an unsafe deserialization routine, which can lead to remote code execution, arbitrary file manipulation, or full site takeover if a usable gadget chain is reachable. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-502 Deserialization of Untrusted Data; the vector confirms the entry point is reachable over the network with no authentication and no user interaction. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited, so real-world impact hinges on the presence of a POP gadget chain in the theme, co-installed plugins, or WordPress core, and on the narrow deployment footprint of this specific commercial theme.
Unauthenticated PHP object injection in the Ancora Themes CleanSkin WordPress theme (versions up to and including 1.5.0) allows remote attackers to pass attacker-controlled serialized data into an endpoint that deserializes it, as reflected by a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vector confirms the attack is network-reachable, low-complexity, and requires neither authentication nor user interaction against reachable installations, though real-world impact hinges on the presence of a usable POP gadget chain in the theme, WordPress core, or co-installed plugins - without one, the outcome may be limited to the injection itself. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing was provided); the available data contains no documented fixed version.
Unauthenticated PHP object injection in Booster for WooCommerce (WordPress plugin slug woocommerce-jetpack, vendor pluggabl) at version 8.4.0 and earlier allows remote attackers to feed attacker-controlled serialized data into the plugin's deserialization path on any internet-facing WordPress/WooCommerce site, with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical) indicating no credentials, no user interaction, and no non-default configuration are required. Escalation to full remote code execution depends on whether a usable PHP POP gadget chain is reachable in the plugin or other loaded code at the point of unserialization, so the practical worst case is complete site compromise while the minimum case is a deserialization primitive with uncertain downstream effect. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; Patchstack is credited as the reporter.
Unauthenticated PHP object injection in Payever WooCommerce Gateway versions up to 4.8.2 allows remote attackers to pass serialized input to an unsafe PHP deserialization path, with a CVSS 3.1 base score of 9.8 reflecting potential full confidentiality, integrity, and availability impact on affected WordPress/WooCommerce sites. The issue is CWE-502 and is network-reachable with low complexity and no privileges or user interaction; no public exploit identified at time of analysis. Practical exploitation may depend on the presence of a usable POP gadget chain, so the real-world outcome can range from limited object injection to full code execution or other high-impact actions.
Unauthenticated local file inclusion in the DirectoryPress WordPress plugin (versions up to and including 3.6.27) allows any remote attacker to read arbitrary files on the hosting server, exposing items such as wp-config.php with database credentials and authentication salts. The reporter's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) reflects a fully remote, unauthenticated, low-complexity attack requiring no user interaction, and the plugin's modest deployment footprint is the main practical limit on exploitation rather than any configuration prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis; independent review narrows realistic impact to confidentiality loss (C:H/I:N/A:N), with escalation to code execution dependent on unconfirmed server conditions such as writable log or session files and PHP wrapper availability.
PHP object injection in the Photolia WordPress theme (versions <= 1.0.3) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to code execution, file manipulation, or data theft if a usable POP gadget chain exists in the WordPress environment. Although rated CVSS 9.8, the practical risk is tempered by the requirement for a reachable gadget chain in core or co-installed components, and no public exploit has been identified at time of analysis. Site owners should treat this as high severity but prioritize based on exposure.
Unauthenticated PHP object injection in the Qwery WordPress theme (versions 3.6.1 and earlier) allows any remote attacker who can reach an affected site to pass crafted serialized data into a PHP deserialization sink, with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, rated 9.8). Because the flaw is CWE-502, real-world impact depends on whether an exploitable PHP gadget chain exists in WordPress core, the theme, or any installed plugin; if such a chain is reachable, the issue can escalate to remote code execution, arbitrary file write, or SQL injection, otherwise impact may be reduced. At the time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, though the unauthenticated network vector and full C/I/A rating make the theme a high-priority item for any internet-facing WordPress installation running it.
Unauthenticated PHP Object Injection in the AFFI - Affiliate Marketing for WooCommerce WordPress plugin (all versions through 1.0.10) allows remote attackers to pass crafted serialized data to PHP unserialize(), enabling arbitrary object instantiation that could lead to remote code execution, file manipulation, or data theft if a viable POP gadget chain exists in the plugin, WordPress core, WooCommerce, or other installed extensions. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required to reach the vulnerable code path, but the independent assessment notes that real-world severity depends heavily on the presence of a usable gadget chain, making the nominal 9.8 score more nuanced in practice. No public exploit identified at time of analysis, and no CISA KEV listing was provided in the intelligence; the sole reference is the Patchstack vulnerability database entry.
Unauthenticated PHP Object Injection in the Anesta WordPress theme (versions up to and including 1.5.3) lets a remote attacker supply a crafted serialized payload that is passed to an unsafe unserialize() call in the theme's code. Because exploitation needs no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), the realistic impact hinges on whether the site exposes a usable POP gadget chain in the theme, WordPress core, or another active plugin - if such a chain exists, the injected object can trigger file operations, SQL, or code execution with full confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was included in the available intelligence; the vulnerable endpoint/parameter is not named in the supplied data and should be confirmed from the Patchstack advisory.
Unauthenticated privilege escalation in the Tonda Membership plugin for WordPress (published by Select Themes) affects all versions up to and including 1.0.1, allowing a remote attacker with no credentials and no user interaction to obtain elevated privileges on an affected site. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates confidentiality, integrity and availability impact as High, so successful abuse can effectively hand over site-level control. The only practical precondition is that the vulnerable plugin be installed and active on a standard WordPress installation; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied. Patchstack is credited as the reporting source and its advisory is the single reference provided.
PHP object injection in the Axiomthemes Balance WordPress theme (versions through 1.12.0) lets uncontrolled serialized data reach a PHP unserialize() call, enabling an attacker to instantiate arbitrary objects within the site's PHP process. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw is remotely reachable without authentication or user interaction, but real-world impact is conditional on the presence of a usable POP gadget chain in the theme, WordPress core, or a co-installed plugin - absent such a gadget the injection can be inert. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-published fix version is present in the available intelligence; note that the publisher's CVSS vector rates complexity as low (base 9.8) whereas our assessment rates it high, so treat the maximal-impact framing with that caveat.
PHP object injection in the ThemeREX Edema WordPress theme (all releases through 1.2.2.2) lets an attacker pass crafted serialized data into an unserialize() call in the theme code, instantiating arbitrary PHP objects and - if a usable POP gadget chain exists in the theme, its bundled libraries, or another installed plugin - escalating to full site compromise. The advisory vector scores this 9.8 (network, low complexity, no privileges, no user interaction), but our independent assessment rates it complexity-high with low privileges required and flags the claimed unauthenticated path as unconfirmed, since many WordPress theme object-injection bugs need at least a low-privileged authenticated user; practical impact therefore hinges on gadget-chain availability rather than the raw CVSS number. No public exploit code and no confirmed active exploitation were identified at time of analysis.
PHP object injection in the Greeny WordPress theme (ThemeREX Group) through version 2.10.0 allows remote attackers to feed crafted serialized data into an unsafe PHP unserialize() call, leading to arbitrary object instantiation and - where a usable POP gadget chain exists in the theme, WordPress core, or another active plugin - code execution or full site compromise. The published scoring rates this 9.8 with network vector, no privileges (PR:N), and no user interaction (UI:N), but the specific vulnerable endpoint and whether authentication is genuinely required are not confirmed by the available data, and our independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) precisely because exploitation hinges on a gadget chain being present rather than on the injection alone. There is no public exploit identified at time of analysis and no CISA KEV listing for this issue.
PHP object injection in the ThemeREX Group Hogwords WordPress theme (all versions through 1.2.7) lets remote attackers supply crafted serialized input to a PHP deserialization routine, which is assessed as unauthenticated and requiring no user interaction (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and can lead to full confidentiality, integrity, and availability loss if a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. The vulnerable theme must be installed and active and the attack surface is any endpoint that passes attacker-controlled data into unserialize()/unserialize-like handling. At time of analysis there is no public exploit identified and no CISA KEV listing, so the practical risk is bounded by the availability of a working gadget chain rather than by demonstrated exploitation; Patchstack reported the issue and no fixed theme version is stated in the supplied data.
PHP object injection in the ThemeREX Hygia WordPress theme (versions through 1.21.0) lets unauthenticated remote attackers pass crafted serialized data into an unsafe PHP deserialization call, which can lead to full compromise of confidentiality, integrity, and availability on any site running the affected theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) confirms the attack is network-reachable with no authentication and no user interaction, making every site with an active vulnerable Hygia install a candidate target. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though the practical ceiling of the attack depends on whether a usable POP gadget chain exists in the theme, WordPress core, or another installed plugin.
PHP object injection in the IPharm WordPress theme through version 1.2.4 can allow remote attackers to pass crafted serialized data into a PHP unserialize() path, potentially enabling object injection and, if a usable gadget chain exists in the theme, WordPress core, or installed plugins, full site compromise. The assigned CVSS score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but the independent assessment adjusts attack complexity to high because the specific vulnerable input vector is not identified and practical impact depends on gadget-chain availability. No public exploit was identified at time of analysis, and no CISA KEV confirmation was provided; authentication requirements from the CVSS vector are PR:N, but unauthenticated reachability is not independently verifiable from the available data.
Unauthenticated PHP Object Injection in the Buzz Stone | Magazine & Viral Blog WordPress theme (vendor themerex) at versions 1.0.2 and earlier lets any remote attacker who can reach an affected request path supply serialized PHP data that the theme passes into an unsafe unserialize() call, yielding a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact). Because the attack is unauthenticated and requires no user interaction, exploitation depends only on the site running this specific niche theme and on a usable POP gadget chain being reachable in the theme, WordPress core, or a co-installed plugin; absent such a gadget, impact is limited to object-injection side effects rather than full remote code execution. No public exploit code has been identified at time of analysis, and the primary limiting factor is narrow deployment - only sites running this particular theme are exposed.
Unauthenticated PHP object injection in the ThemeREX Group 'Booklovers' WordPress theme (all versions through 2.13.0) lets remote attackers feed attacker-controlled serialized data into a PHP unserialize() call, which can corrupt or hijack application logic and, given a reachable gadget chain, escalate to code execution, arbitrary file write, or file deletion. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication or user interaction is required on a default install, and there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV). The practical severity ceiling depends on whether a usable POP gadget chain exists in the theme itself, its bundled plugins, or WordPress core - absent such a chain, exploitation is largely limited to object instantiation with constrained real-world impact.