EUVD-2025-17116
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Deserialization of Untrusted Data vulnerability in AncoraThemes Mr. Murphy allows Object Injection.This issue affects Mr. Murphy: from n/a before 1.2.12.1.
Analysis
Critical deserialization vulnerability in AncoraThemes Mr. Murphy WordPress theme that allows unauthenticated remote attackers to inject arbitrary objects and achieve complete system compromise (confidentiality, integrity, and availability impact). All versions before 1.2.12.1 are vulnerable. With a CVSS score of 9.8 and network-accessible attack vector requiring no authentication or user interaction, this vulnerability presents an immediate, high-priority threat to affected WordPress installations.
Technical Context
This vulnerability stems from CWE-502: Deserialization of Untrusted Data, a class of flaws where applications deserialize untrusted input without proper validation. The AncoraThemes Mr. Murphy theme likely deserializes user-supplied data (possibly from HTTP requests, cached data, or transients) using PHP's unserialize() function or similar mechanisms without sufficient input validation. This enables Object Injection attacks where attackers craft malicious serialized objects that, when deserialized, trigger unintended code execution through PHP's magic methods (__wakeup, __destruct, __toString) or gadget chains within WordPress/installed libraries. The vulnerability is specific to the Mr. Murphy theme (CPE would be: cpe:2.7:a:ancorathemes:mr_murphy:*:*:*:*:*:wordpress:*:*), affecting WordPress installations using this theme on versions before 1.2.12.1.
Affected Products
Mr. Murphy (All versions before 1.2.12.1)
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today