Avventure
Monthly
Unauthenticated PHP object injection in the Avventure WordPress theme through version 1.1.12 gives remote attackers a route to supply serialized data to an unserialize() sink, with CVSS 3.1 scored 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a vuln.today priority decision of act_now. The available sources do not identify the specific theme endpoint or parameter that reaches the sink, and they do not confirm that a usable gadget chain is present for full code execution. No public exploit was identified in the provided data at time of analysis.
Unauthenticated PHP object injection in the Avventure WordPress theme through version 1.1.12 gives remote attackers a route to supply serialized data to an unserialize() sink, with CVSS 3.1 scored 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and a vuln.today priority decision of act_now. The available sources do not identify the specific theme endpoint or parameter that reaches the sink, and they do not confirm that a usable gadget chain is present for full code execution. No public exploit was identified in the provided data at time of analysis.