Unauthenticated PHP object injection in the Ancorathemes Drone Media WordPress theme, affecting all versions through 2.2.0, lets a remote attacker supply a crafted serialized PHP object to a theme-reachable sink without authentication, no user interaction, and low attack complexity, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N base vector scored 9.8. Because successful exploitation depends on a usable property-oriented programming (POP) gadget chain being present in the theme, WordPress core, or an installed plugin, the maximum C:H/I:H/A:H impact - typically code execution, file manipulation, or full site takeover - is only realized when such a chain exists; otherwise the realized impact may be lower. At time of analysis there was no public exploit code identified and no evidence of confirmed active exploitation (not listed in CISA KEV), though the combination of an unauthenticated, network-reachable, low-complexity injection sink makes this a high-priority target for attackers once a chain is publicized. Reported by Patchstack against the CPE cpe:2.3:a:ancorathemes:drone_media.
Unauthenticated PHP object injection in the ThemeRex 'Asia Garden' WordPress theme (versions 1.3.1 and earlier) allows remote attackers to pass crafted serialized data into PHP's unserialize() and instantiate arbitrary objects on the target site. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical), exploitation requires no authentication or user interaction against an affected installation and could yield full confidentiality, integrity, and availability impact - typically arbitrary code execution, file manipulation, or SQL injection when a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (CISA KEV); no EPSS score was supplied. Practical exploitability hinges on the presence of a viable gadget chain, without which impact may drop to denial of service or be difficult to weaponize, and the exact vulnerable parameter/endpoint is not detailed in the available data.
Unauthenticated PHP object injection in the WordPress theme N7 | Golf Club Sports & Events (versions 2.21 and earlier, vendor ThemeREX) lets a remote attacker supply a crafted serialized PHP object to a theme endpoint without any authentication or user interaction, yielding a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Because no public exploit code and no CISA KEV entry were identified at time of analysis, real-world impact hinges on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin; where such a chain is reachable, the deserialization flaw can escalate to full remote code execution. Exposure is limited to sites that have this specific niche golf/sports theme installed and active, but for those sites the worst-case profile is complete compromise by an unauthenticated attacker.
Unauthenticated PHP object injection in the ThemeRex Invetex WordPress theme affects versions 2.18 and earlier, allowing remote attackers to supply crafted serialized input to a theme endpoint that performs unsafe deserialization. Successful exploitation can lead to full compromise of the confidentiality, integrity, and availability of the affected site, but the practical ceiling depends on whether a usable PHP POP gadget chain exists in the theme, an active plugin, or WordPress core. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS score should be weighed against the assessed AC:H rather than the reported AC:L.
Unauthenticated PHP object injection in the ThemeRex 'Law Office' WordPress theme at version 3.20 and earlier lets remote attackers with no credentials and no user interaction pass attacker-controlled serialized data into an unsafe unserialize() path, which the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) scores as complete loss of confidentiality, integrity and availability. Practical impact depends heavily on whether a usable POP gadget chain exists in the theme, an installed plugin, or WordPress core; without a reachable gadget the result may be far below the theoretical 9.8 headline score. No CISA KEV entry, EPSS score, or public exploit code is present in the available intelligence, so this is assessed as no public exploit identified at time of analysis, and exposure is limited to sites running this commercial legal-industry theme.
Unauthenticated PHP Object Injection in the ThemeREX Group Camelia WordPress theme (versions through 1.2.15) lets a remote attacker supply crafted serialized input that the theme passes to PHP's unserialize(), enabling injection of arbitrary PHP objects into the application's execution flow. Per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), no authentication and no user interaction are required, and the potential impact spans full loss of confidentiality, integrity, and availability - typically realized as remote code execution, arbitrary file manipulation, or SQL injection when a usable POP gadget chain is reachable. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); practical exploitability is gated by the availability of a viable gadget chain across the theme, WordPress core, or co-installed plugins.
Unauthenticated PHP object injection in the ThemeREX Convex WordPress theme (versions through 1.16.0) allows remote attackers to pass crafted serialized data to an unserialize() call, potentially leading to remote code execution, file manipulation, or SQL injection if a suitable POP gadget chain is present. The vulnerability is network-reachable with no authentication or user interaction required, but successful exploitation is dependent on the target environment loading a reachable gadget chain in the theme, an active plugin, or WordPress core; independent analysis therefore rates complexity as high (AC:H) despite the original Patchstack CVSS score of 9.8 (AC:L). No public exploit code or confirmed active exploitation has been identified at time of analysis.
PHP object injection in the ThemeREX Group Dwell WordPress theme (versions up to and including 1.16.0) allows unauthenticated remote attackers to send crafted serialized data to an unserialize() sink, which can lead to file deletion, SQL injection, or remote code execution if a usable POP gadget chain exists in the site's installed theme, plugins, or WordPress core. The published CVSS score is 9.8, but independent assessment rates attack complexity as high because real-world impact depends entirely on gadget-chain availability in the specific deployment; no public exploit code or confirmed active exploitation was identified at time of analysis. This is a WordPress theme vulnerability reported by Patchstack and tracked as EUVD-2026-96188.
Unauthenticated PHP object injection in the ThemeREX Let's Play (playhockey) WordPress theme, versions through 1.1.15, allows remote attackers to pass crafted serialized data to an unserialize() call inside the theme, which can trigger object injection and may escalate to code execution, data theft, or full site compromise when a usable POP gadget chain is reachable. No vendor-released fixed version was identified and no public exploit code was identified at time of analysis. Exploitation is assessed as requiring a viable property-oriented programming gadget chain in the theme, installed plugins, or WordPress core, so the practical attack complexity is raised to High even though the attack surface remains network-reachable and unauthenticated.
PHP object injection in the Partiso WordPress theme (ThemeREX Group) through version 1.1.13 allows unauthenticated remote attackers to pass attacker-controlled serialized data into unserialize(), which per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector requires no credentials and no user interaction on a default installation. The 9.8 severity reflects the theoretical worst case of high confidentiality, integrity and availability impact, but actual exploitation depends on the presence of a usable POP gadget chain in the theme, a co-installed plugin, or WordPress core - without such a chain the practical impact is materially lower. No vendor-released patch version is stated in the available data, and no public exploit code was identified at time of analysis; the issue was reported through Patchstack's vulnerability disclosure program.
Unauthenticated PHP object injection in the ThemeREX Group Rosalinda WordPress theme, affecting all versions through 1.2.4, lets remote attackers reach an unserialize() sink and inject arbitrary PHP objects. The reported CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), though independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because meaningful exploitation additionally requires a usable POP gadget chain in the theme, WordPress core, or an installed plugin; the deserialization primitive alone is inert without one. The CVSS vector confirms no authentication or user interaction is needed to reach the sink, and while the advisory does not name the specific endpoint or parameter, no public exploit code has been identified at time of analysis.
PHP object injection in the ThemeREX Group Smart Casa WordPress theme, affecting all versions up to and including 1.0.12, lets remote attackers supply crafted serialized input to an unserialize() call without authentication (CVSS PR:N/UI:N), with the vendor/Patchstack score reaching 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Meaningful impact - remote code execution, arbitrary file write, or SQL injection - depends on a usable POP gadget chain being reachable in the theme, WordPress core, or an installed plugin, which is why our independent assessment rates the vector at AC:H despite the 9.8 base score; sites running only the theme, or with a reduced plugin set, may be far less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but Patchstack's database entry (https://patchstack.com/database/wordpress/theme/smart-casa/vulnerability/wordpress-smart-casa-theme-1-0-12-php-object-injection-vulnerability?_s_id=cve) makes the flaw publicly documented and easily locatable by attackers.
ThemeREX Smash WordPress theme through version 1.12.0 contains a PHP object injection vulnerability (CWE-502) that is triggered when untrusted data is deserialized. The published CVSS 3.1 vector scores 9.8 Critical (AV:N/AC:L/PR:N/UI:N), indicating remote, unauthenticated, low-complexity exploitation, but the independent assessment raises attack complexity to High because a usable POP gadget chain must exist in loaded WordPress core, theme, or plugin code, and the advisory does not name the vulnerable parameter, endpoint, or sink. No public exploit identified at time of analysis; limiting factors include the theme's install base, the need for a reachable gadget chain, and the possibility that the vulnerable input is only accessible to authenticated users.
PHP object injection in the ThemeREX Tantra WordPress theme (versions through 2.9.0) allows unauthenticated remote attackers to trigger unserialize() on malicious input, potentially leading to arbitrary code execution, data theft, or site takeover if a usable POP gadget chain is present. The flaw is rated CVSS 9.8 (CWE-502) and requires no privileges or user interaction, though practical impact depends on the availability of a gadget chain in the theme, an installed plugin, or WordPress core. No public exploit code has been identified at the time of analysis.
Code injection in openapi-typescript-codegen through 0.31.0 allows attackers who control or influence an OpenAPI document to inject arbitrary JavaScript into generated TypeScript clients, which then executes when the client is imported or its service methods are called. Exploitation requires the victim to generate a client from an attacker-controlled spec (user interaction), and no public exploit code has been identified at time of analysis. The vendor/VulnCheck CVSS 4.0 base score is 9.3, though the independent assessment notes a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H reflecting the required user interaction; it is not listed in CISA KEV.
SQL injection in the ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes WordPress plugin (versions 1.5.3 and earlier) lets an attacker inject arbitrary SQL through an unsanitized request parameter and read sensitive data from the site's underlying WordPress/WooCommerce database. The vendor-published CVSS 3.1 base score is 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L) and the CWE is CWE-89; however, our independent assessment rates the same vector at PR:L because the vulnerability is titled a 'Subscriber' SQL injection, indicating that a logged-in low-privilege account (subscriber role) is the practical prerequisite - a requirement easily satisfied on sites with open user registration. Per the assessed vector this is an authenticated (PR:L), remotely reachable, network-based injection with no user interaction, high confidentiality impact, low availability impact, and no public exploit code identified at time of analysis; the CVSS privilege-level discrepancy between vendor (PR:N) and our assessment (PR:L) should be confirmed with the vendor.
Unauthenticated SQL injection in StyleMix's uListing WordPress plugin, affecting versions up to and including 2.2.0, allows remote attackers to inject arbitrary SQL into the site's backend database queries via an insufficiently sanitized plugin input. The assessed vector (AV:N/AC:L/PR:N/UI:N) means any network-reachable WordPress installation with the plugin active is exposed without credentials or user interaction, with confidentiality impact rated high and limited integrity impact; availability is unaffected. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exact vulnerable parameter, request endpoint, and any required non-default configuration remain unconfirmed by the available Patchstack advisory, so the practical attack surface should be verified against the plugin source or vendor documentation.
Blind SQL injection in the Tickera WordPress event ticketing plugin, affecting versions through 3.6.0.6, lets a remote attacker inject crafted input into a plugin SQL query and exfiltrate database contents one inference at a time. The vulnerability is scored by its reporter at CVSS 9.3 (network reachable, low complexity, scope-changing, high confidentiality impact), while our own assessment is more conservative - CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:N/C:H/I:N/A:N - because the specific vulnerable endpoint or parameter is not named and Patchstack-documented plugin SQLi issues frequently require a logged-in role. The supplied vector states PR:N (unauthenticated) but the alternative assessment assumes PR:L, so authentication requirements are not confirmed from the available data; no public exploit code and no confirmed active exploitation were identified at time of analysis. Because exploitation is blind and inference-based, extraction is slower than a direct-query injection, though AC:L means it remains automatable once a working payload path is found.
Missing authentication in the MAX platform adapter of cc-connect through 1.5.0 allows remote attackers to forge webhook updates and, by supplying an allowed or admin user_id, trigger privileged host commands such as /shell. The flaw only materialises when the MAX adapter is deployed in webhook mode with no webhook_secret configured and its listener on port 8080 is network-reachable; configuring a secret eliminates the exposure entirely. At time of analysis there is no CISA KEV entry, no vendor-released patch version published, and no public exploit identified, though the technical bar to exploitation is low once the misconfiguration is present.
Unauthenticated remote attackers can delete arbitrary files on WordPress/WooCommerce sites running the PPOM - Product Addons & Custom Fields for WooCommerce plugin through version 34.0.10, abusing insufficient path validation in the rename_files function that is reachable via the plugin's cart/order file-handling path. Removing critical files such as wp-config.php can push the site into a re-installation state that is readily leveraged for remote code execution, and because the relocated file is moved byte-identically into the web-accessible wp-content/uploads/ppom_files/confirmed/ directory, the same flaw also exposes arbitrary file read for anything the web server user can read. Wordfence rates it 9.1 and independent assessment confirms CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. no authentication, privileges, or user interaction required against default internet-exposed configurations; no public exploit code has been identified at time of analysis. This is a genuine high-priority issue, not a CVSS-inflated one, with the main precondition being simply that the vulnerable plugin version is installed, active, and serving requests.
Unauthenticated attackers can trigger arbitrary WordPress action hooks on sites running the Avada (Fusion) Builder plugin up to and including 7.16.1, because the plugin dispatches a hook whose name is taken directly from an attacker-supplied form-field value without verifying authorization. The demonstrated impact is permanent destruction of site content - a crafted request deleted trashed posts, pages, and comments via the core wp_scheduled_delete action - with denial of service (e.g. wp_maybe_auto_update) and, where additional vulnerable third-party hook handlers are installed, further privileged writes; a blind arbitrary user/post-meta read also exists but its results are delivered only to the site owner and are not attacker-exfiltrable. Rated CVSS 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H), this is a genuine high-priority issue rather than an inflated score, though it is not confirmed actively exploited and no public exploit code has been identified at time of analysis. The vendor addressed it in Avada 7.16.2.
Unauthenticated privilege escalation in the Blocksy Companion WordPress plugin (versions up to and including 2.1.58) allows remote attackers to register and be automatically logged into a Dokan 'seller' (vendor) account, gaining publishing capabilities beyond those of a normal customer - even on sites where Dokan vendor signup is explicitly disabled. The flaw lies in the plugin's implement_user_registration() AJAX handler, which disables Dokan's vendor-registration nonce check and trusts an attacker-supplied role parameter passed to WooCommerce's customer-creation functions, giving a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N). Exploitation requires the Dokan multivendor plugin and WooCommerce to be active alongside the vulnerable Blocksy Companion, and no public exploit code has been identified at time of analysis.
An out-of-bounds read in the T_STD_STRING typemap shipped with ExtUtils-Typemaps-Default before 1.06 causes the generated C++ conversion to evaluate SvCUR($arg) before stringifying the argument, so a derived XS/C++ module that passes a non-string Perl scalar (integer, number, or reference) into the std::string conversion can read an invalid length and abort or segfault the process. The defect is not present in a running service by default but is compiled into derivative XS modules, and it only triggers when the build toolchain's unspecified argument-evaluation order happens to evaluate the length macro first, so exposure is conditional rather than universal. The headline CVSS 9.1 conflicts sharply with the authoritative assessment (AC:H, C:L/A:H) and a very low EPSS of 0.19% (8th percentile); no public exploit code was identified at time of analysis.
Unauthenticated arbitrary file upload in the Tailored Tools plugin for WordPress (versions up to and including 3.0.3) allows remote attackers to write attacker-controlled files to the web server, which can be escalated to remote code execution where the uploaded file type is executable. The vulnerability is rated CVSS 9.0 (assessed vector AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H) and requires no authentication or user interaction, though the high attack-complexity component indicates a non-trivial precondition such as path/filename guessing or a specific plugin configuration that must be satisfied for a successful upload. No public exploit code was identified and the issue is not listed as confirmed actively exploited (CISA KEV) at time of analysis; real-world exposure is limited mainly by the plugin's narrow deployment footprint.
Heap buffer overflow in Apache DataSketches C++ (versions 1.0.0-incubating through 5.2.0) allows an unauthenticated remote attacker who can supply a crafted HLL sketch for deserialization to write up to 988 bytes past a fixed 8-entry internal heap buffer, corrupting memory, crashing the process, and potentially enabling further exploitation. The vulnerable code is a library routine with no network listener of its own, so real-world exposure hinges on whether the consuming application deserializes sketch images from untrusted byte buffers or streams; services that only process trusted or internally generated sketches are not realistically exposed despite the AV:N vector. No public exploit code has been identified at time of analysis, and EPSS is low at 0.21% (11th percentile), while the assessed CVSS 3.1 base of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst case for applications that do accept untrusted sketches, meaning the high score and low observed exploitation signal must be weighed together.
Out-of-bounds read and write in the CPC sketch deserialization path of Apache DataSketches C++ (datasketches-cpp) - specifically cpc_sketch::deserialize() called on a byte buffer or a stream - allows a crafted serialized sketch to corrupt heap memory: the decompressor reads past the end of the compressed data because the read position was only checked after decoding finished, and in the hybrid flavor it writes outside an internal heap buffer because decoded row indices were not validated, crashing the process with potential for further exploitation. All releases from 2.0.0-incubating before 5.3.0 are affected, and the CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating remote, unauthenticated impact, but reachability is conditional: only applications that deserialize CPC sketches from untrusted sources are exposed, since the flaw lives in a C++ library whose attack surface depends on the embedding application. Exploitation signals are mixed and should be weighed carefully - EPSS is only 0.19% (8th percentile), there is no CISA KEV entry, and no public exploit identified at time of analysis.
Out-of-bounds read in Apache DataSketches C++ versions 3.1.0 through 5.2.0 is reachable when an application deserializes a compact Theta sketch from an untrusted source, allowing unauthenticated remote attackers to crash the process (denial of service) and potentially disclose adjacent memory contents. The flaw sits in compact_theta_sketch::deserialize() and wrapped_compact_theta_sketch::wrap(), which parse header fields before verifying the input length; in the compressed format a 32-bit integer overflow defeats the length check and two decoding-controlling header fields go unvalidated, and the stream-based deserialization path is affected as well. Apache rates this issue low severity in its 5.3.0 release notes, no public exploit code has been identified at time of analysis, the vulnerability is not in CISA KEV, and EPSS is only 0.20% (9th percentile); exploitation requires the explicit, non-default precondition that the host application accept Theta sketch images from untrusted sources, so the practical priority is lower than the raw 9.1 CVSS might suggest.