Unauthenticated remote code execution affects Floci versions 1.1.0 through releases prior to 2.2.0, where the API Gateway VTL template engine fails to sandbox Velocity template rendering. An attacker who can reach the Floci control plane can define a REST API with a MOCK integration whose mapping template uses $util reflection to reach Runtime or ProcessBuilder, executing arbitrary OS commands inside the Floci JVM - a CVSS 9.3 (CVSS 4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) impact confirmed as unauthenticated by the PR:N vector. Publicly available exploit code exists, though no public exploit identified at time of analysis as confirmed actively exploited (CISA KEV), and a vendor-released fix is available in Floci 2.2.0. Because Floci is primarily a local and CI developer emulator of AWS services, practical exposure depends heavily on whether its API Gateway/AppSync endpoints are bound beyond localhost.
Unauthenticated remote code execution in the WordPress plugin SiteVault - Backup, Restore, Migration & Cloning (royal_plugins) at version 1.5.19 and earlier lets any remote attacker run arbitrary PHP code on an affected site with no login, no special configuration, and no user interaction, yielding CVSS 10.0 / 9.8-class impact. Any WordPress installation with this plugin installed and active is exposed; sites that never installed it, or that have upgraded past 1.5.19, are unaffected. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, but the low complexity and zero prerequisites make this a genuine high-priority issue rather than a CVSS-inflated paper risk, and full site compromise (including database and backup archives) is the realistic outcome of exploitation.
Authenticated arbitrary file upload in the CodeBard Help Desk WordPress plugin (versions up to and including 1.1.2) lets any logged-in user holding only a subscriber-level account push an executable PHP file onto the server through the plugin's ticket/attachment upload path, which typically converts into full remote code execution on the WordPress host. The flaw is rated CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) - the scope change reflects that a low-privileged plugin user can compromise the whole site, not just the plugin - and requires no administrator rights and no victim interaction, though it does require an account on the target site (trivially obtained wherever open or self-service registration is enabled). At time of analysis there is no CISA KEV entry and no public exploit code identified for this issue; the practical urgency therefore turns on how easily an attacker can register a subscriber account on the target installation. This is a genuine high-priority issue, not a CVSS-inflated one.
Arbitrary file upload in the WordPress plugin Creator LMS (by WPFunnels) versions 1.2.21 and earlier lets an authenticated user holding only Contributor-level privileges upload a file of an attacker-chosen type to the web server, which can be leveraged to drop and execute server-side code on the host. The vulnerability is rated Critical (CVSS 3.1 base 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting no user interaction and no administrative access requirement once a Contributor account exists, with scope change indicating impact beyond the plugin itself to the underlying site. At time of analysis there is no public exploit identified and the CVE is not listed in CISA KEV, though the low privilege bar and the open-registration patterns common on LMS sites make this a high-priority item for any WordPress installation running this plugin.
Unauthenticated remote code execution affects Expivi 3D Product Configurator for WooCommerce through version 2.16.2. Missing authentication and nonce checks on the wp_loaded handler, combined with unsanitized xpv_image POST input echoed into a Dompdf-rendered .phtml template with PHP execution enabled, lets any remote attacker execute code on the server. No public exploit identified at time of analysis; CVSS 9.8 and CWE-434 indicate critical, unauthenticated risk.
Unauthenticated arbitrary file upload in the WordPress plugin Extensions For CF7 (Contact Form 7 Database, Conditional Fields and Redirection) versions up to and including 3.4.5 allows remote attackers to write attacker-controlled files into the site's upload directory through the plugin's signature field, with remote code execution as the likely outcome. The flaw is reachable via the extcf7_submit function without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) but only on sites that have a Contact Form 7 form actually using the plugin's signature field; sites not exposing that field are not reachable through this vector. At time of analysis no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), and the vendor has released a fix in version 3.4.6, so the exposure window is bounded by how quickly affected sites update.
PHP object injection in the Dynamic User Directory WordPress plugin (versions 2.4 and earlier) allows an attacker holding a low-privileged account to feed attacker-controlled serialized data into an unserialize() call, potentially enabling arbitrary file operations, data disclosure, or remote code execution if a usable POP gadget chain exists within the plugin, WordPress core, or a co-installed plugin. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N), but our independent assessment lowers the privileges-required metric to Low (PR:L) because the Patchstack 'Subscriber' designation means the attacker must already hold a subscriber-level WordPress account; sites that disable open user registration substantially limit exposure. No public exploit code or confirmed active exploitation was identified at time of analysis.
Privilege escalation in the miniOrange OTP Verification WordPress plugin through 5.5.7 allows an attacker to gain elevated privileges on affected sites; the supplied CVSS 3.1 vector scores it 9.8 Critical (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H), describing a remote, unauthenticated, low-complexity flaw, though the incorrect privilege assignment (CWE-266) may in practice require a low-privileged authenticated account and authentication requirements are not confirmed from available data. No public exploit code or active exploitation (CISA KEV) is identified in the provided intelligence.
Unauthenticated attackers can bypass two-factor authentication and obtain a fully authenticated session for any 2FA-enabled account - including administrators - on WordPress sites running the Advanced IP Blocker plugin through version 8.13.13, without ever supplying a password. The plugin's step-2 handler fails to verify that step-1 password authentication was completed and leaks reusable interim and verify nonces to any unauthenticated caller, while the 6-digit TOTP comparison has no attempt counter, no account lockout, and does not fire wp_login_failed, so an attacker can brute-force up to roughly 10^6 codes for a known user_id and receive a session cookie via wp_set_auth_cookie, resulting in complete site takeover. No public exploit identified at time of analysis, and exploitation requires only that the targeted account has the plugin's own 2FA feature enabled and that the attacker knows its user_id (administrator accounts are commonly user_id 1).
Privilege escalation in the AIWU WordPress plugin (ai-copilot-content-generator) through version 1.5.9 lets a low-privileged Subscriber account elevate itself to a higher role, up to administrator, by abusing incorrect privilege assignment (CWE-266) in the plugin. Sites are fully exposed when the WordPress 'Anyone can register' option is enabled, since an attacker can self-provision the required Subscriber account; where registration is closed, the attacker must already hold or be granted such an account. Our independent assessment scores this as CVSS 9.8 with PR:L (Subscriber required), which conflicts with the supplied PR:N vector, so the unauthenticated framing should be verified against the Patchstack advisory; no public exploit identified at time of analysis, and no confirmed active exploitation (no CISA KEV listing).
Authentication bypass in the WPCOM Member WordPress plugin (all versions up to and including 1.7.27) allows remote, unauthenticated attackers to establish a fully authenticated WordPress session as any user, including administrators, by forging a session entry that the plugin's social-login callback later resolves to a victim's bound social identifier. The published CVSS is 9.8, but independent assessment rates it AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H: exploitation is gated by two real-world prerequisites - the target must have at least one social login provider configured (which is what registers the vulnerable callback on the WordPress init hook), and the attacker must know or be able to enumerate the victim account's bound openid/unionid, with admin takeover specifically requiring the administrator's identifier. Cross-referenced sources show no CISA KEV entry and no public exploit code identified at time of analysis, so the practical risk is best characterized as a genuine high-priority issue whose severity is tempered by the non-universal configuration requirement and the prior-knowledge hurdle rather than a universally exploitable 9.8.
Attackers can delete arbitrary files outside the intended directory in rtMedia for WordPress, BuddyPress and bbPress (buddypress-media) versions up to 4.7.13 due to a path traversal flaw, causing high integrity and availability impact. The published CVSS score is 9.8, but our assessment indicates a likely authenticated vector (PR:L) and no confidentiality impact; authentication requirements are not confirmed from available data. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated PHP object injection in the ThemeRex WineShop WordPress theme (all versions up to and including 3.20) lets remote attackers push attacker-controlled serialized data into a PHP unserialize() operation, enabling instantiation of arbitrary PHP objects and - where a usable gadget chain exists in the theme, co-installed plugins, or the runtime - remote code execution, arbitrary file read/write, or SQL injection. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), meaning exploitation against a default installation requires no authentication and no user interaction, per the published PR:N/UI:N vector. At time of analysis there is no public exploit code identified and the theme is not listed in CISA KEV; practical exposure is limited to sites actually running this niche wine-shop theme and by whether an exploitable POP gadget chain is reachable.
Unauthenticated PHP object injection in the ThemeRex Equadio WordPress theme (versions up to and including 1.1.4) allows remote attackers to supply crafted serialized input to vulnerable deserialization entry points, potentially leading to remote code execution, file deletion, or other high-impact outcomes depending on available gadget chains. The flaw carries a CVSS 3.1 base score of 9.8, reflecting network exploitability with low complexity, no authentication, and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, though the severity and ease of exploitation make prompt patching critical.
Unauthenticated PHP Object Injection in the ThemeRex 'Juno' WordPress theme affects all versions up to and including 2.25, allowing remote attackers to supply a crafted serialized PHP object that the theme deserializes without validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates this as a network-reachable, low-complexity flaw requiring no credentials and no user interaction, with high confidentiality, integrity and availability impact; however, real-world impact depends on whether a usable POP gadget chain exists in the theme or in co-installed plugins, which is not confirmed in the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis (Patchstack is credited as the reporting source), and exploitation is limited to the subset of WordPress sites running this specific commercial theme at an affected version.
Unauthenticated PHP object injection in the BoldThemes Avala WordPress theme at version 1.1.4 and earlier lets remote attackers pass attacker-controlled data into PHP's unserialize() through a publicly reachable code path, with no authentication or user interaction required (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Real-world impact - remote code execution, arbitrary file read/write/delete, or SQL injection - depends on the presence of a usable POP/gadget chain in the theme itself, WordPress core, or another installed plugin; without such a chain the injection may be inert, so the 9.8 score represents a worst-case profile rather than a guaranteed outcome. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation requires the Avala theme to be installed and active at version 1.1.4 or below.
Unauthenticated PHP object injection in the Kalles WordPress theme (versions up to and including 1.1.7.1) allows a remote attacker to pass crafted serialized data into a PHP unserialize() call, which on a site that loads a usable gadget chain can escalate to full compromise of the WordPress installation - sensitive data theft, arbitrary content or code modification, and denial of service. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity flaw requiring no credentials and no user interaction, consistent with the CWE-502 classification, and no public exploit has been identified at time of analysis. Real-world impact is bounded by gadget availability in the surrounding WordPress core, plugins, and bundled libraries, so not every installation will reach the full high-confidentiality/integrity/availability outcome.
Unauthenticated PHP object injection in the ThemeRex 'Yacht Rental' WordPress theme affects all versions up to and including 2.6, allowing a remote attacker to pass crafted serialized data into a PHP deserialization path without credentials or user interaction. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the theoretical worst case is high confidentiality, integrity, and availability impact with a 9.8 base score. No public exploit code has been identified at time of analysis, and the practical severity depends on whether a usable PHP gadget chain exists within the theme, WordPress core, or co-installed plugins - without such a gadget, real-world impact may be reduced.
Unauthenticated PHP Object Injection in the Wine House WordPress theme (version 3.20 and earlier, distributed by ThemeREX) allows a remote attacker to deliver a crafted serialized payload to an unserialize() call, which the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates at 9.8 Critical with full Confidentiality, Integrity, and Availability impact. Because PR:N and UI:N are confirmed by the vector, no authentication or victim interaction is required - any unauthenticated request to the affected endpoint against a site with the theme installed and active can carry the payload. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical severity is bounded by whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins; absent such a gadget, impact may degrade to denial of service or be non-exploitable, and the target population is limited to sites running this single commercial theme.
Unauthenticated PHP object injection in the ThemeREX Tipsy WordPress theme through version 1.6 allows remote attackers to supply crafted serialized data that the theme passes to PHP unserialize(), potentially leading to remote code execution, file manipulation, or SQL injection where a usable POP gadget chain exists. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the flaw is network-reachable, low-complexity, and requires neither authentication nor user interaction, with full confidentiality, integrity, and availability impact (9.8). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation is constrained by the need for an exploitable gadget chain in the theme, WordPress core, or an active plugin.
Unauthenticated PHP object injection in the Stargaze WordPress theme (versions 1.10 and earlier) allows remote attackers to submit a crafted serialized payload that the theme feeds to PHP's unserialize(), which can trigger arbitrary object instantiation and, where a usable gadget chain is present, code execution or full site compromise; the maximum-base CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact. Per that vector no authentication (PR:N) and no user interaction (UI:N) are required, and the CPE record cpe:2.3:a:themerex:stargaze ties the exposure to the ThemeREX Stargaze theme, so only sites with this theme installed and active are in scope. At time of analysis there is no public exploit identified, and the practical ceiling on impact depends on whether a viable POP gadget chain exists in the theme itself, a co-installed plugin, or WordPress core.
Unauthenticated PHP object injection in the ThemeRex Splendour WordPress theme (versions 1.23 and earlier) lets remote attackers pass crafted serialized data into an unsafe deserialization routine, which can lead to remote code execution, arbitrary file manipulation, or full site takeover if a usable gadget chain is reachable. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-502 Deserialization of Untrusted Data; the vector confirms the entry point is reachable over the network with no authentication and no user interaction. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited, so real-world impact hinges on the presence of a POP gadget chain in the theme, co-installed plugins, or WordPress core, and on the narrow deployment footprint of this specific commercial theme.
Unauthenticated PHP object injection in the Ancora Themes CleanSkin WordPress theme (versions up to and including 1.5.0) allows remote attackers to pass attacker-controlled serialized data into an endpoint that deserializes it, as reflected by a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vector confirms the attack is network-reachable, low-complexity, and requires neither authentication nor user interaction against reachable installations, though real-world impact hinges on the presence of a usable POP gadget chain in the theme, WordPress core, or co-installed plugins - without one, the outcome may be limited to the injection itself. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing was provided); the available data contains no documented fixed version.
Unauthenticated PHP object injection in Booster for WooCommerce (WordPress plugin slug woocommerce-jetpack, vendor pluggabl) at version 8.4.0 and earlier allows remote attackers to feed attacker-controlled serialized data into the plugin's deserialization path on any internet-facing WordPress/WooCommerce site, with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical) indicating no credentials, no user interaction, and no non-default configuration are required. Escalation to full remote code execution depends on whether a usable PHP POP gadget chain is reachable in the plugin or other loaded code at the point of unserialization, so the practical worst case is complete site compromise while the minimum case is a deserialization primitive with uncertain downstream effect. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; Patchstack is credited as the reporter.
Unauthenticated PHP object injection in Payever WooCommerce Gateway versions up to 4.8.2 allows remote attackers to pass serialized input to an unsafe PHP deserialization path, with a CVSS 3.1 base score of 9.8 reflecting potential full confidentiality, integrity, and availability impact on affected WordPress/WooCommerce sites. The issue is CWE-502 and is network-reachable with low complexity and no privileges or user interaction; no public exploit identified at time of analysis. Practical exploitation may depend on the presence of a usable POP gadget chain, so the real-world outcome can range from limited object injection to full code execution or other high-impact actions.
Unauthenticated local file inclusion in the DirectoryPress WordPress plugin (versions up to and including 3.6.27) allows any remote attacker to read arbitrary files on the hosting server, exposing items such as wp-config.php with database credentials and authentication salts. The reporter's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) reflects a fully remote, unauthenticated, low-complexity attack requiring no user interaction, and the plugin's modest deployment footprint is the main practical limit on exploitation rather than any configuration prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis; independent review narrows realistic impact to confidentiality loss (C:H/I:N/A:N), with escalation to code execution dependent on unconfirmed server conditions such as writable log or session files and PHP wrapper availability.
PHP object injection in the Photolia WordPress theme (versions <= 1.0.3) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to code execution, file manipulation, or data theft if a usable POP gadget chain exists in the WordPress environment. Although rated CVSS 9.8, the practical risk is tempered by the requirement for a reachable gadget chain in core or co-installed components, and no public exploit has been identified at time of analysis. Site owners should treat this as high severity but prioritize based on exposure.
Unauthenticated PHP object injection in the Qwery WordPress theme (versions 3.6.1 and earlier) allows any remote attacker who can reach an affected site to pass crafted serialized data into a PHP deserialization sink, with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, rated 9.8). Because the flaw is CWE-502, real-world impact depends on whether an exploitable PHP gadget chain exists in WordPress core, the theme, or any installed plugin; if such a chain is reachable, the issue can escalate to remote code execution, arbitrary file write, or SQL injection, otherwise impact may be reduced. At the time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, though the unauthenticated network vector and full C/I/A rating make the theme a high-priority item for any internet-facing WordPress installation running it.
Unauthenticated PHP Object Injection in the AFFI - Affiliate Marketing for WooCommerce WordPress plugin (all versions through 1.0.10) allows remote attackers to pass crafted serialized data to PHP unserialize(), enabling arbitrary object instantiation that could lead to remote code execution, file manipulation, or data theft if a viable POP gadget chain exists in the plugin, WordPress core, WooCommerce, or other installed extensions. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication or user interaction is required to reach the vulnerable code path, but the independent assessment notes that real-world severity depends heavily on the presence of a usable gadget chain, making the nominal 9.8 score more nuanced in practice. No public exploit identified at time of analysis, and no CISA KEV listing was provided in the intelligence; the sole reference is the Patchstack vulnerability database entry.
Unauthenticated PHP Object Injection in the Anesta WordPress theme (versions up to and including 1.5.3) lets a remote attacker supply a crafted serialized payload that is passed to an unsafe unserialize() call in the theme's code. Because exploitation needs no credentials and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8), the realistic impact hinges on whether the site exposes a usable POP gadget chain in the theme, WordPress core, or another active plugin - if such a chain exists, the injected object can trigger file operations, SQL, or code execution with full confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was included in the available intelligence; the vulnerable endpoint/parameter is not named in the supplied data and should be confirmed from the Patchstack advisory.
Unauthenticated privilege escalation in the Tonda Membership plugin for WordPress (published by Select Themes) affects all versions up to and including 1.0.1, allowing a remote attacker with no credentials and no user interaction to obtain elevated privileges on an affected site. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates confidentiality, integrity and availability impact as High, so successful abuse can effectively hand over site-level control. The only practical precondition is that the vulnerable plugin be installed and active on a standard WordPress installation; no public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied. Patchstack is credited as the reporting source and its advisory is the single reference provided.
PHP object injection in the Axiomthemes Balance WordPress theme (versions through 1.12.0) lets uncontrolled serialized data reach a PHP unserialize() call, enabling an attacker to instantiate arbitrary objects within the site's PHP process. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw is remotely reachable without authentication or user interaction, but real-world impact is conditional on the presence of a usable POP gadget chain in the theme, WordPress core, or a co-installed plugin - absent such a gadget the injection can be inert. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-published fix version is present in the available intelligence; note that the publisher's CVSS vector rates complexity as low (base 9.8) whereas our assessment rates it high, so treat the maximal-impact framing with that caveat.
PHP object injection in the ThemeREX Edema WordPress theme (all releases through 1.2.2.2) lets an attacker pass crafted serialized data into an unserialize() call in the theme code, instantiating arbitrary PHP objects and - if a usable POP gadget chain exists in the theme, its bundled libraries, or another installed plugin - escalating to full site compromise. The advisory vector scores this 9.8 (network, low complexity, no privileges, no user interaction), but our independent assessment rates it complexity-high with low privileges required and flags the claimed unauthenticated path as unconfirmed, since many WordPress theme object-injection bugs need at least a low-privileged authenticated user; practical impact therefore hinges on gadget-chain availability rather than the raw CVSS number. No public exploit code and no confirmed active exploitation were identified at time of analysis.
PHP object injection in the Greeny WordPress theme (ThemeREX Group) through version 2.10.0 allows remote attackers to feed crafted serialized data into an unsafe PHP unserialize() call, leading to arbitrary object instantiation and - where a usable POP gadget chain exists in the theme, WordPress core, or another active plugin - code execution or full site compromise. The published scoring rates this 9.8 with network vector, no privileges (PR:N), and no user interaction (UI:N), but the specific vulnerable endpoint and whether authentication is genuinely required are not confirmed by the available data, and our independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) precisely because exploitation hinges on a gadget chain being present rather than on the injection alone. There is no public exploit identified at time of analysis and no CISA KEV listing for this issue.
PHP object injection in the ThemeREX Group Hogwords WordPress theme (all versions through 1.2.7) lets remote attackers supply crafted serialized input to a PHP deserialization routine, which is assessed as unauthenticated and requiring no user interaction (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and can lead to full confidentiality, integrity, and availability loss if a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. The vulnerable theme must be installed and active and the attack surface is any endpoint that passes attacker-controlled data into unserialize()/unserialize-like handling. At time of analysis there is no public exploit identified and no CISA KEV listing, so the practical risk is bounded by the availability of a working gadget chain rather than by demonstrated exploitation; Patchstack reported the issue and no fixed theme version is stated in the supplied data.
PHP object injection in the ThemeREX Hygia WordPress theme (versions through 1.21.0) lets unauthenticated remote attackers pass crafted serialized data into an unsafe PHP deserialization call, which can lead to full compromise of confidentiality, integrity, and availability on any site running the affected theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) confirms the attack is network-reachable with no authentication and no user interaction, making every site with an active vulnerable Hygia install a candidate target. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though the practical ceiling of the attack depends on whether a usable POP gadget chain exists in the theme, WordPress core, or another installed plugin.
PHP object injection in the IPharm WordPress theme through version 1.2.4 can allow remote attackers to pass crafted serialized data into a PHP unserialize() path, potentially enabling object injection and, if a usable gadget chain exists in the theme, WordPress core, or installed plugins, full site compromise. The assigned CVSS score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but the independent assessment adjusts attack complexity to high because the specific vulnerable input vector is not identified and practical impact depends on gadget-chain availability. No public exploit was identified at time of analysis, and no CISA KEV confirmation was provided; authentication requirements from the CVSS vector are PR:N, but unauthenticated reachability is not independently verifiable from the available data.
Unauthenticated PHP Object Injection in the Buzz Stone | Magazine & Viral Blog WordPress theme (vendor themerex) at versions 1.0.2 and earlier lets any remote attacker who can reach an affected request path supply serialized PHP data that the theme passes into an unsafe unserialize() call, yielding a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact). Because the attack is unauthenticated and requires no user interaction, exploitation depends only on the site running this specific niche theme and on a usable POP gadget chain being reachable in the theme, WordPress core, or a co-installed plugin; absent such a gadget, impact is limited to object-injection side effects rather than full remote code execution. No public exploit code has been identified at time of analysis, and the primary limiting factor is narrow deployment - only sites running this particular theme are exposed.
Unauthenticated PHP object injection in the ThemeREX Group 'Booklovers' WordPress theme (all versions through 2.13.0) lets remote attackers feed attacker-controlled serialized data into a PHP unserialize() call, which can corrupt or hijack application logic and, given a reachable gadget chain, escalate to code execution, arbitrary file write, or file deletion. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication or user interaction is required on a default install, and there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV). The practical severity ceiling depends on whether a usable POP gadget chain exists in the theme itself, its bundled plugins, or WordPress core - absent such a chain, exploitation is largely limited to object instantiation with constrained real-world impact.
PHP object injection in the ThemeREX Gutentype WordPress theme (all versions through 2.1.12) allows remote, unauthenticated attackers to inject arbitrary PHP objects through unsafe deserialization of untrusted data, with the potential for full confidentiality, integrity, and availability impact if a usable gadget chain is reachable. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but the independent assessment rates attack complexity as High because practical exploitation depends on the presence of a suitable POP gadget chain in the theme, WordPress core, or an installed plugin - without one, real-world impact is likely lower than the base score implies. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing); exploitation is bounded to sites running the Gutentype theme, unpatched, at version 2.1.12 or earlier.
PHP object injection in the ThemeREX Travesia WordPress theme (versions up to and including 1.1.16) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to arbitrary code execution or other severe impacts if a usable POP gadget chain exists in the theme or other installed components. The vulnerability has a CVSS score of 9.8 and requires no authentication or user interaction. No public exploit code or active exploitation has been identified at time of analysis, and no vendor patch has been confirmed as available.
PHP object injection in the Axiomthemes Veto WordPress theme (all versions through 1.6.0) lets remote attackers hand untrusted serialized data to PHP's unserialize(), which can instantiate arbitrary classes if a usable gadget chain is reachable. The attack is network-reachable against a default theme install and, per the assessed vector (PR:N/UI:N), requires neither authentication nor user interaction, though the assessed attack complexity is High (AC:H) because exploitation depends on a POP chain being present in the theme, an installed plugin, or WordPress core. Practical impact is therefore conditional: the 9.8-style severity reflects worst-case object injection outcomes rather than a guaranteed code-execution path, and no public exploit has been identified at time of analysis. Note the affected product is a niche commercial theme, and no fixed version is stated in the available data.
Unauthenticated PHP object injection in the ThemeREX Jacqueline WordPress theme (versions 2.22 and earlier) can let remote attackers achieve full confidentiality, integrity, and availability impact (CVSS 9.8) if a usable POP gadget chain is reachable in the theme or other installed WordPress components. Exploitation requires no authentication or user interaction against a site with the theme active, but the practical impact depends on the presence of a viable gadget chain. No public exploit has been identified at time of analysis, and no vendor-released patch was found in the provided data.
Unauthenticated PHP Object Injection in the ThemeREX Alliance WordPress theme (versions 3.11 and earlier) allows remote attackers to pass crafted serialized data into a PHP unserialize() call, which can lead to arbitrary object instantiation and, where a usable POP gadget chain exists, full compromise of the underlying site with high impact to confidentiality, integrity and availability. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no authentication or user interaction is required and default installations are reachable over the network; at time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, though the EPSS-style risk profile of an unauthenticated WordPress theme flaw of this class typically rises quickly once details circulate. Practical impact depends on the presence of a reachable gadget chain in the theme, WordPress core, or other installed plugins; sites without such a chain may see reduced, but still material, exposure because the injection primitive itself is remotely reachable.
Unauthenticated PHP object injection in the Kicker WordPress theme (AxiomThemes), affecting versions 2.2.1 and earlier, lets any remote attacker reach an unsafe PHP deserialization sink without credentials or user interaction - the only prerequisite is that the theme is active on a network-reachable WordPress site. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, high C/I/A), the practical severity hinges on CWE-502's classic caveat: achieving code execution, file deletion, or data exfiltration requires a usable POP gadget chain in the theme, an installed plugin, or WordPress core, so impact may be materially lower on sites without a suitable chain. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; Patchstack published the advisory and no vendor-released patch has been confirmed in the provided data.
Unauthenticated PHP object injection in the AxiomThemes 'Original' WordPress theme (all versions up to and including 1.9.0) lets a remote attacker reach a code path that passes attacker-controlled input into PHP's unserialize(), exposing affected sites to high impact across confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the root cause is CWE-502, the practical ceiling of exploitation depends on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin - without one, outcomes may be limited to lower-impact effects rather than full code execution. No public exploit code has been identified at time of analysis, there is no CISA KEV entry indicating confirmed active exploitation, and no EPSS score was supplied with the source data, so this should be treated as a severe latent exposure rather than a confirmed campaign.
Unauthenticated PHP object injection in the FC United WordPress theme (Axiom Themes, versions up to and including 1.1.1) allows remote attackers to pass crafted serialized input that the theme unserializes without validation, potentially leading to code execution, file manipulation, or database compromise depending on the gadget chains available on the host site. The 9.8 CVSS score reflects a fully remote, unauthenticated attack path with no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but there is no public exploit identified at time of analysis and no CISA KEV listing; all severity signals are theoretical rather than empirical. Real-world impact is further bounded by CWE-502's dependency on a reachable POP gadget chain in the theme, WordPress core, or an installed plugin, and by the theme's limited deployment footprint.
Unauthenticated PHP object injection in the ThemeREX ShiftCV WordPress theme, affecting versions up to and including 3.0.14, lets remote attackers feed crafted serialized input into an unsafe deserialization sink, which can escalate to remote code execution when a usable POP gadget chain is reachable in the theme, WordPress core, or an installed plugin. The flaw carries a 9.8 Critical rating (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication and no user interaction are required and successful exploitation can fully compromise confidentiality, integrity and availability. There is no public exploit identified at time of analysis and no CISA KEV confirmation, so the practical limiting factor is the availability of a reachable gadget chain rather than the injection primitive itself; no EPSS score was supplied in the available intelligence.
Unauthenticated PHP object injection in the WordPress theme Windsor (ThemeREX) through version 2.10 lets remote attackers feed crafted serialized data into an unserialize() call reachable without authentication or user interaction, scoring a maximum base 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Reported by Patchstack and tracked as CWE-502, the flaw's realized impact depends on whether a usable PHP gadget chain exists across the theme, WordPress core, and installed plugins - in an unpatched site with a suitable gadget, this can escalate to code execution, arbitrary file or data manipulation, whereas without one the injection may be largely inert. At time of analysis there is no public exploit code identified and no CISA KEV listing, so exploitation is not confirmed in the wild; no vendor-released fix version appears in the available advisory data. Given the unauthenticated, network-reachable profile and the prevalence of gadget-rich plugin stacks, this should be treated as high priority for any site running the theme.
Unauthenticated PHP object injection in the ThemeRex Education Center WordPress theme (versions up to and including 3.6.12) lets remote attackers feed serialized data into an unserialize() sink with no authentication and no user interaction, scored CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Actual damage depends on whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins, because that determines whether object injection escalates to code execution or full confidentiality, integrity, and availability loss. No public exploit code and no CISA KEV listing were identified at time of analysis, and real-world exposure is constrained by the narrow installed base of this specific commercial theme.