Alliance
Monthly
Unauthenticated PHP Object Injection in the ThemeREX Alliance WordPress theme (versions 3.11 and earlier) allows remote attackers to pass crafted serialized data into a PHP unserialize() call, which can lead to arbitrary object instantiation and, where a usable POP gadget chain exists, full compromise of the underlying site with high impact to confidentiality, integrity and availability. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no authentication or user interaction is required and default installations are reachable over the network; at time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, though the EPSS-style risk profile of an unauthenticated WordPress theme flaw of this class typically rises quickly once details circulate. Practical impact depends on the presence of a reachable gadget chain in the theme, WordPress core, or other installed plugins; sites without such a chain may see reduced, but still material, exposure because the injection primitive itself is remotely reachable.
Unauthenticated PHP Object Injection in the ThemeREX Alliance WordPress theme (versions 3.11 and earlier) allows remote attackers to pass crafted serialized data into a PHP unserialize() call, which can lead to arbitrary object instantiation and, where a usable POP gadget chain exists, full compromise of the underlying site with high impact to confidentiality, integrity and availability. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), so no authentication or user interaction is required and default installations are reachable over the network; at time of analysis no public exploit code has been identified and the issue is not listed in CISA KEV, though the EPSS-style risk profile of an unauthenticated WordPress theme flaw of this class typically rises quickly once details circulate. Practical impact depends on the presence of a reachable gadget chain in the theme, WordPress core, or other installed plugins; sites without such a chain may see reduced, but still material, exposure because the injection primitive itself is remotely reachable.