Axiomthemes
Monthly
PHP object injection in the axiomthemes Holistic Center WordPress theme through 1.2.6 exposes a deserialization path for attacker-controlled serialized input, and the input assigns CVSS 9.8 with an act_now priority. The independent assessment records AC:H because concrete impact depends on a usable POP or magic-method gadget chain in the theme, WordPress core, or co-installed plugins, and the supplied sources do not identify the vulnerable sink, exact trigger, or a working chain. No public exploit is identified at time of analysis, and exposure is limited to sites running this theme at an affected version.
PHP object injection in the axiomthemes Hallelujah theme (all versions through 1.1.1) lets remote, unauthenticated attackers feed untrusted serialized data into a PHP deserialization sink, and the CVSS 3.1 score of 9.8 reflects high confidentiality, integrity and availability impact with no privileges or user interaction required. The single available reference, the Patchstack vulnerability entry, does not name the parameter, endpoint or theme feature that reaches the unserialize() call, and it is not confirmed whether a usable POP gadget chain exists in the theme, WordPress core or a co-installed plugin. No CISA KEV entry and no public exploit code were identified at time of analysis, while the vuln.today decision label is act_now, so the incomplete exploitability picture rather than a demonstrated attack is what drives urgency.
PHP object injection in the axiomthemes Reprizo WordPress theme, versions through 1.0.8, lets remote attackers supply serialized data that the theme passes to an unsafe deserialization call, potentially leading to object injection in the WordPress runtime. The vendor-assigned CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the priority decision is act_now given the network-reachable, pre-auth vector claimed by the score; only sites running this specific theme at 1.0.8 or earlier are in scope. No public exploit or proof-of-concept has been identified at time of analysis, the issue is not in CISA KEV, and realistic impact hinges on whether a usable POP gadget chain exists in the theme or an accompanying plugin, which the available sources do not confirm.
PHP object injection in the Axiomthemes Rhodos WordPress theme, affecting versions through 1.3.3, allows remote attackers to feed untrusted serialized data into a PHP unserialize() sink; the supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N with 9.8 severity, so no authentication or user interaction is required per those metrics. Beyond the injection itself, meaningful impact depends on whether a usable POP gadget chain is loadable in the theme or in co-installed plugins, which the available sources do not confirm; the trigger endpoint, parameter and configuration are not described in the available sources. No CISA KEV entry or confirmed public exploit is indicated at time of analysis, and the vuln.today decision label is act_now based on the Patchstack report.
PHP object injection in the Axiomthemes Redy WordPress theme through version 1.3.5 lets unauthenticated remote attackers pass untrusted data into a deserialization path, rated 9.8 under the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Whether object instantiation converts into concrete impact such as file write, SQL injection or code execution depends on a usable POP gadget chain being present in the theme, WordPress core or an installed plugin; the specific vulnerable feature, parameter or configuration is not described in the available sources. Patchstack reported the issue and the CVE org record points to its advisory, while the priority decision is act_now; no KEV listing, no confirmed public exploit code and no EPSS value were supplied, and no fixed version is listed in the available evidence.
Unauthenticated PHP object injection in the Kicker WordPress theme (AxiomThemes), affecting versions 2.2.1 and earlier, lets any remote attacker reach an unsafe PHP deserialization sink without credentials or user interaction - the only prerequisite is that the theme is active on a network-reachable WordPress site. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, high C/I/A), the practical severity hinges on CWE-502's classic caveat: achieving code execution, file deletion, or data exfiltration requires a usable POP gadget chain in the theme, an installed plugin, or WordPress core, so impact may be materially lower on sites without a suitable chain. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; Patchstack published the advisory and no vendor-released patch has been confirmed in the provided data.
Unauthenticated PHP object injection in the AxiomThemes 'Original' WordPress theme (all versions up to and including 1.9.0) lets a remote attacker reach a code path that passes attacker-controlled input into PHP's unserialize(), exposing affected sites to high impact across confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the root cause is CWE-502, the practical ceiling of exploitation depends on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin - without one, outcomes may be limited to lower-impact effects rather than full code execution. No public exploit code has been identified at time of analysis, there is no CISA KEV entry indicating confirmed active exploitation, and no EPSS score was supplied with the source data, so this should be treated as a severe latent exposure rather than a confirmed campaign.
Unauthenticated PHP object injection in the FC United WordPress theme (Axiom Themes, versions up to and including 1.1.1) allows remote attackers to pass crafted serialized input that the theme unserializes without validation, potentially leading to code execution, file manipulation, or database compromise depending on the gadget chains available on the host site. The 9.8 CVSS score reflects a fully remote, unauthenticated attack path with no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but there is no public exploit identified at time of analysis and no CISA KEV listing; all severity signals are theoretical rather than empirical. Real-world impact is further bounded by CWE-502's dependency on a reachable POP gadget chain in the theme, WordPress core, or an installed plugin, and by the theme's limited deployment footprint.
Local file inclusion in the Kids Care WordPress theme through version 3.2.4 allows unauthenticated remote attackers to manipulate a file-inclusion parameter and read local server files, with wp-config.php and other readable files as the primary exposure. The base CVSS vector is 8.1 with High Attack Complexity, but the independent assessment keeps the same unauthenticated and no-user-interaction prerequisites while bounding realistic impact to confidentiality-heavy local file disclosure with Low integrity and availability impact unless log poisoning or PHP wrappers enable escalation. No CISA KEV activity is identified in the provided data, and no public exploit identified at time of analysis; the independent assessment rates this as a credible but not top-tier priority.
PHP object injection in the Axiomthemes Balance WordPress theme (versions through 1.12.0) lets uncontrolled serialized data reach a PHP unserialize() call, enabling an attacker to instantiate arbitrary objects within the site's PHP process. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw is remotely reachable without authentication or user interaction, but real-world impact is conditional on the presence of a usable POP gadget chain in the theme, WordPress core, or a co-installed plugin - absent such a gadget the injection can be inert. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-published fix version is present in the available intelligence; note that the publisher's CVSS vector rates complexity as low (base 9.8) whereas our assessment rates it high, so treat the maximal-impact framing with that caveat.
PHP object injection in the Axiomthemes Veto WordPress theme (all versions through 1.6.0) lets remote attackers hand untrusted serialized data to PHP's unserialize(), which can instantiate arbitrary classes if a usable gadget chain is reachable. The attack is network-reachable against a default theme install and, per the assessed vector (PR:N/UI:N), requires neither authentication nor user interaction, though the assessed attack complexity is High (AC:H) because exploitation depends on a POP chain being present in the theme, an installed plugin, or WordPress core. Practical impact is therefore conditional: the 9.8-style severity reflects worst-case object injection outcomes rather than a guaranteed code-execution path, and no public exploit has been identified at time of analysis. Note the affected product is a niche commercial theme, and no fixed version is stated in the available data.
PHP Object Injection in the AI ANN WordPress theme (by AxiomThemes) affects all versions up to and including 1.29.0, allowing unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the theme. When a suitable POP (property-oriented programming) gadget chain is present in the theme, WordPress core, or an active plugin, this can escalate to remote code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis, though the CVSS 9.8 rating reflects the unauthenticated, network-reachable nature of the flaw.
PHP Object Injection in the Agricola WordPress theme (versions ≤ 1.21.0 by AxiomThemes) lets unauthenticated remote attackers inject crafted serialized PHP objects that are deserialized by the application, and with a suitable POP gadget chain this can escalate to arbitrary file operations, SQL manipulation, or remote code execution. Rated CVSS 9.8 and disclosed by Patchstack (EUVD-2026-53878), it requires no authentication or user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP Object Injection in the A.Williams (Alisha Williams) WordPress theme by AxiomThemes affects all versions up to and including 1.3.1, allowing remote unauthenticated attackers to inject crafted serialized PHP objects into an unsafe deserialization sink. When a suitable POP gadget chain is present in the theme or co-installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the 9.8 CVSS reflects theoretical worst-case impact rather than confirmed active exploitation.
Unauthenticated PHP Object Injection in the 69 Clothing WordPress theme (versions up to and including 1.2.11.1) lets remote attackers submit crafted serialized data that is unsafely deserialized, potentially triggering property-oriented programming (POP) gadget chains for code execution, data theft, or file manipulation. Reported by Patchstack and tracked as EUVD-2026-53989, it carries a critical CVSS 9.8 with no authentication required. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated nature makes it a high-priority patching target for any WordPress site running this theme.
Remote PHP object injection in the axiomthemes '777' (triple-seven) WordPress theme allows attackers to instantiate arbitrary PHP objects by supplying crafted serialized data to a vulnerable unserialize() call, affecting all versions up to and including 1.13.0. With the reported CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8, an unauthenticated network attacker can achieve high-impact compromise if a usable POP gadget chain is present. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated local file inclusion in the Reprizo WordPress theme by AxiomThemes (versions 1.0.8 and earlier) allows remote attackers to coerce the PHP include/require chain into loading arbitrary server-side files, leading to disclosure of sensitive configuration data and potential code execution if uploaded or log files can be referenced. No public exploit identified at time of analysis, but the issue is tracked by Patchstack as a high-severity flaw against a commercial WordPress theme.
Unauthenticated local file inclusion in the Promo WordPress theme through version 1.3.0 allows remote attackers to coerce the application into including arbitrary PHP files from the server, potentially leading to source code disclosure, sensitive file reads, or remote code execution where attacker-controlled files are reachable. The vulnerability is reported by Patchstack and affects axiomthemes' Promo theme; no public exploit identified at time of analysis and EPSS data was not provided. The CVSS 3.1 base score of 8.1 reflects high impact across confidentiality, integrity, and availability despite high attack complexity.
A PHP object injection vulnerability exists in the Axiom Themes m2 | Construction and Tools Store theme through version 1.1.2, stemming from unsafe deserialization of untrusted data (CWE-502). This allows remote attackers to inject malicious serialized objects that can lead to arbitrary code execution or privilege escalation depending on available gadget chains in the WordPress environment. No CVSS score, EPSS data, or KEV status is currently available, but the vulnerability was reported by Patchstack and affects all installations running the vulnerable theme version.
Broken access control in the QuickCal Appointment Booking Calendar WordPress plugin (versions ≤ 1.0.16) allows authenticated users holding the Booking Agent role to bypass authorization checks and access functionality or data outside their intended privilege scope. The flaw, rooted in CWE-862 Missing Authorization, enables high-confidentiality and high-availability impact - suggesting attackers can both read sensitive booking/customer data and disrupt the scheduling service. No public exploit or CISA KEV listing is identified at time of analysis, though the Patchstack advisory confirms the issue.
Local file inclusion in the Axiomthemes Crafti WordPress theme (versions up to and including 1.12) allows remote unauthenticated attackers to coerce the PHP runtime into including arbitrary local files through improperly validated include/require parameters. Successful exploitation can lead to disclosure of sensitive server-side files, configuration data, and under certain conditions code execution via included content. No public exploit identified at time of analysis, but the issue is catalogued by Patchstack in their WordPress vulnerability database.
Local File Inclusion in Axiomthemes Confidant WordPress theme (versions up to and including 1.4) allows remote unauthenticated attackers to include arbitrary local PHP files on the server, potentially leading to sensitive information disclosure and code execution. The vulnerability is reported by Patchstack with a CVSS 8.1 (High) rating; no public exploit identified at time of analysis and the CVE is not present in CISA KEV. The high attack complexity (AC:H) suggests exploitation requires specific conditions to be met, despite the network-reachable, no-auth attack surface.
Local file inclusion in the Giardino WordPress theme (versions ≤1.1.10) allows unauthenticated attackers to read arbitrary files from the server, such as configuration files and source code. Exploitation requires high attack complexity and can lead to full system compromise if code execution is achieved through chaining. No active exploitation or public exploit has been identified, and the EPSS score is very low (0.08%).
Local file inclusion in axiomthemes Katelyn WordPress theme versions through 1.0.10 allows unauthenticated remote attackers to read arbitrary local files, potentially exposing sensitive data or leading to code execution. Exploitation does not require authentication but has high attack complexity, and no public exploit or active exploitation has been identified.
PHP Local File Inclusion in the Pinevale WordPress theme (<=1.0.14) allows unauthenticated attackers to include arbitrary local files on the server, potentially leading to remote code execution under high-complexity conditions. No active exploitation or public exploit has been identified, but the vulnerability carries a CVSS 8.1 score and affects all prior versions.
Local file inclusion in axiomthemes Renewal WordPress theme versions ≤1.2.2 allows unauthenticated attackers to read arbitrary local files by manipulating input to a PHP include/require statement. Successful exploitation could expose sensitive data such as wp-config.php credentials, with potential limited code execution via log poisoning. EPSS indicates very low exploitation probability (0.08%), and no active exploitation or public proof-of-concept is currently known.
Local file inclusion in the Rosalinda WordPress theme ≤1.2.3 permits unauthenticated attackers to arbitrarily include local files, leading to information disclosure and potential remote code execution. The vulnerability is rated high severity (CVSS 8.1) but has low exploitation likelihood (EPSS 0.08%), and there is no evidence of active exploitation or public exploit code at this time.
Unauthenticated Local File Inclusion in the Panda WordPress theme up to version 1.21 allows remote attackers to read arbitrary server files and potentially escalate to code execution. The vulnerability is not known to be actively exploited and has an EPSS score of 0.08%, indicating low real-world exploitation probability at this time.
Local file inclusion in the Soleil WordPress theme (versions through 1.17) allows unauthenticated attackers to include arbitrary local files via a network request, potentially exposing sensitive data or enabling remote code execution. Exploitation requires high attack complexity, and no active exploitation or public proof-of-concept is currently known.
Local file inclusion in the Tripster WordPress theme (versions <= 1.0.10) allows unauthenticated attackers to read and execute arbitrary files on the server, potentially
Local file inclusion in the Ipharm WordPress theme (versions up to 1.2.3) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving code execution. No public exploit or active exploitation is known, and EPSS probability is very low (0.08%), though the CVSS score of 8.1 indicates high potential impact.
Local file inclusion in the AxiomThemes HeartStar WordPress theme permits unauthenticated attackers to include arbitrary local files, potentially leading to remote code execution or full site compromise. The vulnerability affects versions up to and including 1.0.14. While there is no confirmed active exploitation or public exploit code, the EPSS score of 0.08% suggests a very low exploitation probability.
Local File Inclusion (LFI) in axiomthemes Lione WordPress theme versions up to 1.16 allows unauthenticated remote attackers to include arbitrary local files via a crafted request. Successful exploitation can lead to sensitive data exposure and, if combined with other attack vectors such as file uploads, remote code execution. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently known; EPSS indicates a low probability of exploitation (0.08%).
Local file inclusion in axiomthemes Spock WordPress theme through version 1.17 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive information. While high complexity limits exploitability, successful exploitation could lead to full system compromise via techniques like log poisoning. No public exploit code or active exploitation has been reported, and EPSS indicates a very low likelihood of real-world attacks.
Local file inclusion in the Aromatica WordPress theme (versions <= 1.8) allows unauthenticated attackers to read arbitrary files on the server, potentially leading to sensitive information disclosure or remote code execution if combined with other techniques. The vulnerability is not known to be actively exploited, with a low exploitation probability (EPSS 0.08%).
Local file inclusion in axiomthemes Athos WordPress theme up to version 1.9 allows unauthenticated attackers to include arbitrary local files, potentially achieving remote code execution and full site compromise. Exploitation requires high attack complexity, and while no public exploit or active exploitation is currently known, the impact is critical if successfully leveraged.
Local file inclusion in axiomthemes Vocal WordPress theme versions up to 1.12 allows unauthenticated attackers to read arbitrary files on the server by manipulating file path parameters in PHP include/require statements. No active exploitation or public exploit code has been reported; EPSS score is very low (0.08%), indicating minimal immediate risk.
Local file inclusion in the EcoGrow WordPress theme (up to version 1.7) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive configuration data like wp-config.php. While no active exploitation or public exploit code is known, the high CVSS score reflects possible escalation to full server compromise if the PHP environment supports wrapper-based code execution. The low EPSS score (0.08%) suggests very limited exploitation likelihood at this time.
Local file inclusion in the Manufactory WordPress theme (<=1.4) allows unauthenticated attackers to read arbitrary files from the server. While the CVSS 8.1 indicates high severity, EPSS exploitation probability is low (0.08%) and no public exploit or active exploitation has been identified.
Local file inclusion in the Agricola WordPress theme (version 1.1.0 and below) allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure and remote code execution if combined with PHP code injection into a readable file. The vulnerability has a high CVSS score (8.1) but is not known to be actively exploited, and EPSS predicts a very low (0.08%) chance of exploitation.
Local file inclusion in Dwell theme for WordPress versions ≤1.7.0 allows remote unauthenticated attackers to read arbitrary files on the server. The vulnerability, identified by Patchstack, carries a CVSS 8.1 but has very low EPSS exploitation probability and no known public exploit or active targeting. Successful exploitation could lead to full compromise if sensitive files are exfiltrated.
Local file inclusion in the Fabric WordPress theme (≤1.5.0) allows unauthenticated attackers to include arbitrary PHP files, leading to potential remote code execution or sensitive data exposure. Exploitation requires high attack complexity, and no public exploit or active exploitation (KEV) has been reported, with EPSS indicating a 0.08% probability of widespread use.
Local file inclusion in the Basil WordPress theme (up to version 1.3.12) allows unauthenticated remote attackers to read arbitrary files from the server. The vulnerability has a CVSS score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) but a very low EPSS probability (0.08%), and no active exploitation or public exploit code has been detected.
Local file inclusion in the Tacticool WordPress theme through version 1.0.13 allows unauthenticated attackers to include arbitrary local files, potentially disclosing sensitive information or executing code. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently reported.
Local file inclusion in the Catamaran WordPress theme up to version 1.15 lets unauthenticated remote attackers read arbitrary server files and, in certain configurations, escalate to full code execution. The vulnerability stems from improper filename control in a PHP include/require statement, exposing websites using the theme to data theft and server compromise. No active exploitation or public exploit code is known, and EPSS probability is low (0.08%).
Local file inclusion in the Lunna WordPress theme (versions ≤1.15) permits unauthenticated remote attackers to include arbitrary local files, leading to sensitive data exposure and potential remote code execution. The vulnerability carries a CVSS score of 8.1, but exploitation requires high attack complexity and has an EPSS probability of just 0.08%, making widespread automated attack improbable.
Local file inclusion in The Gig WordPress theme <=1.18.0 allows unauthenticated attackers to read arbitrary files from the server and potentially escalate to code execution. The flaw arises from improper sanitization of filenames passed to PHP include/require statements, enabling path traversal. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.
Local file inclusion in the Anubis WordPress theme up to version 1.25 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive configuration data. Successful exploitation can lead to full compromise if combined with other vulnerabilities, though attack complexity is high. No active exploitation or public exploit code has been reported, and EPSS indicates low likelihood of widespread exploitation.
PHP Local File Inclusion in the axiomthemes Prisma WordPress theme (all versions through 1.10) lets remote unauthenticated attackers coerce the application into including arbitrary local files, exposing sensitive data and potentially achieving code execution via included PHP payloads. Reported by Patchstack, the flaw carries a CVSS 8.1 (high) rating but a low EPSS of 0.08% (23rd percentile), and there is no public exploit identified at time of analysis. Not listed in CISA KEV.
Local File Inclusion in axiomthemes Palatio WordPress theme through version 1.6 allows unauthenticated remote attackers to include arbitrary local files on the server, potentially leading to information disclosure and code execution. The vulnerability has high attack complexity and no user interaction; it has not been observed in active exploitation, and no public exploit code has been identified at time of analysis.
Remote unauthenticated local file inclusion in the FitFlex WordPress theme (version up to 1.6) allows attackers to read arbitrary server-side files, potentially exposing configuration data, credentials, or enabling further exploitation. The vulnerability carries a high CVSS score (8.1) but EPSS prediction is low (0.08%), and no public exploit or active exploitation is confirmed at the time of analysis.
Local File Inclusion in the Pantry WordPress theme through version 1.4 allows unauthenticated attackers to include arbitrary local files, leading to full site compromise – including information disclosure, arbitrary code execution, and complete integrity and availability loss. The vulnerability carries a CVSS base score of 8.1 but has a very low EPSS exploitation probability (0.08%); no active exploitation or public exploit code has been identified at this time.
Local file inclusion in the Good Mood WordPress theme (versions up to 1.16) allows unauthenticated attackers to read arbitrary files from the server, with potential for remote code execution if server configuration permits remote file inclusion. No active exploitation or public exploit code has been identified at this time, but the CVSS 8.1 score reflects high potential impact.
Local file inclusion in the Alright WordPress theme (up to version 1.6.1) allows unauthenticated attackers to read arbitrary local files. Exploitation complexity is high (CVSS 8.1), and no public exploit or active exploitation has been identified at time of analysis, but EPSS is low (0.08%).
Local file inclusion (LFI) in the Axiomthemes Towny WordPress theme <= 1.16 allows unauthenticated attackers to read arbitrary local files on the server, potentially exposing credentials or other sensitive data. The vulnerability has a CVSS base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicating high impact but elevated attack complexity, and an EPSS score of 0.08% suggesting very low likelihood of widespread exploitation. No active exploitation or public proof-of-concept code has been identified at this time.
Local file inclusion in the Algenix WordPress theme through version 1.0 allows remote, unauthenticated attackers to read arbitrary files on the server. Exploitation requires high attack complexity, likely due to path traversal constraints or the need to chain with other conditions. No active exploitation or public proof-of-concept is confirmed, and the EPSS risk is very low (0.08%).
PHP Local File Inclusion in the Hygia WordPress theme up to version 1.16 allows unauthenticated remote attackers to read arbitrary local files on the server, potentially compromising credentials or enabling further attacks. Exploitation complexity is high (CVSS AC:H), and no active exploitation or public exploit code has been identified at this time. The EPSS score is low (0.08%), indicating a low likelihood of widespread exploitation.
SQL injection in axiomthemes smartSEO WordPress theme versions up to 4.0 enables authenticated attackers to extract sensitive database information and potentially cause service disruption. Exploitation requires low-privilege authenticated access but can impact resources beyond the vulnerable component (scope change). EPSS score of 0.05% indicates low observed exploitation probability, with no CISA KEV listing or public POC identified at time of analysis.
Critical deserialization of untrusted data vulnerability in Axiomthemes Sweet Dessert that enables object injection attacks. The vulnerability affects Sweet Dessert versions before 1.1.13 and allows remote attackers to inject malicious serialized objects without authentication, potentially achieving remote code execution with complete system compromise. With a CVSS score of 9.8 and network-based attack vector requiring no user interaction or privileges, this represents a critical internet-exposed risk.
PHP object injection in the axiomthemes Holistic Center WordPress theme through 1.2.6 exposes a deserialization path for attacker-controlled serialized input, and the input assigns CVSS 9.8 with an act_now priority. The independent assessment records AC:H because concrete impact depends on a usable POP or magic-method gadget chain in the theme, WordPress core, or co-installed plugins, and the supplied sources do not identify the vulnerable sink, exact trigger, or a working chain. No public exploit is identified at time of analysis, and exposure is limited to sites running this theme at an affected version.
PHP object injection in the axiomthemes Hallelujah theme (all versions through 1.1.1) lets remote, unauthenticated attackers feed untrusted serialized data into a PHP deserialization sink, and the CVSS 3.1 score of 9.8 reflects high confidentiality, integrity and availability impact with no privileges or user interaction required. The single available reference, the Patchstack vulnerability entry, does not name the parameter, endpoint or theme feature that reaches the unserialize() call, and it is not confirmed whether a usable POP gadget chain exists in the theme, WordPress core or a co-installed plugin. No CISA KEV entry and no public exploit code were identified at time of analysis, while the vuln.today decision label is act_now, so the incomplete exploitability picture rather than a demonstrated attack is what drives urgency.
PHP object injection in the axiomthemes Reprizo WordPress theme, versions through 1.0.8, lets remote attackers supply serialized data that the theme passes to an unsafe deserialization call, potentially leading to object injection in the WordPress runtime. The vendor-assigned CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the priority decision is act_now given the network-reachable, pre-auth vector claimed by the score; only sites running this specific theme at 1.0.8 or earlier are in scope. No public exploit or proof-of-concept has been identified at time of analysis, the issue is not in CISA KEV, and realistic impact hinges on whether a usable POP gadget chain exists in the theme or an accompanying plugin, which the available sources do not confirm.
PHP object injection in the Axiomthemes Rhodos WordPress theme, affecting versions through 1.3.3, allows remote attackers to feed untrusted serialized data into a PHP unserialize() sink; the supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N with 9.8 severity, so no authentication or user interaction is required per those metrics. Beyond the injection itself, meaningful impact depends on whether a usable POP gadget chain is loadable in the theme or in co-installed plugins, which the available sources do not confirm; the trigger endpoint, parameter and configuration are not described in the available sources. No CISA KEV entry or confirmed public exploit is indicated at time of analysis, and the vuln.today decision label is act_now based on the Patchstack report.
PHP object injection in the Axiomthemes Redy WordPress theme through version 1.3.5 lets unauthenticated remote attackers pass untrusted data into a deserialization path, rated 9.8 under the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Whether object instantiation converts into concrete impact such as file write, SQL injection or code execution depends on a usable POP gadget chain being present in the theme, WordPress core or an installed plugin; the specific vulnerable feature, parameter or configuration is not described in the available sources. Patchstack reported the issue and the CVE org record points to its advisory, while the priority decision is act_now; no KEV listing, no confirmed public exploit code and no EPSS value were supplied, and no fixed version is listed in the available evidence.
Unauthenticated PHP object injection in the Kicker WordPress theme (AxiomThemes), affecting versions 2.2.1 and earlier, lets any remote attacker reach an unsafe PHP deserialization sink without credentials or user interaction - the only prerequisite is that the theme is active on a network-reachable WordPress site. Rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N, high C/I/A), the practical severity hinges on CWE-502's classic caveat: achieving code execution, file deletion, or data exfiltration requires a usable POP gadget chain in the theme, an installed plugin, or WordPress core, so impact may be materially lower on sites without a suitable chain. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; Patchstack published the advisory and no vendor-released patch has been confirmed in the provided data.
Unauthenticated PHP object injection in the AxiomThemes 'Original' WordPress theme (all versions up to and including 1.9.0) lets a remote attacker reach a code path that passes attacker-controlled input into PHP's unserialize(), exposing affected sites to high impact across confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the root cause is CWE-502, the practical ceiling of exploitation depends on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin - without one, outcomes may be limited to lower-impact effects rather than full code execution. No public exploit code has been identified at time of analysis, there is no CISA KEV entry indicating confirmed active exploitation, and no EPSS score was supplied with the source data, so this should be treated as a severe latent exposure rather than a confirmed campaign.
Unauthenticated PHP object injection in the FC United WordPress theme (Axiom Themes, versions up to and including 1.1.1) allows remote attackers to pass crafted serialized input that the theme unserializes without validation, potentially leading to code execution, file manipulation, or database compromise depending on the gadget chains available on the host site. The 9.8 CVSS score reflects a fully remote, unauthenticated attack path with no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but there is no public exploit identified at time of analysis and no CISA KEV listing; all severity signals are theoretical rather than empirical. Real-world impact is further bounded by CWE-502's dependency on a reachable POP gadget chain in the theme, WordPress core, or an installed plugin, and by the theme's limited deployment footprint.
Local file inclusion in the Kids Care WordPress theme through version 3.2.4 allows unauthenticated remote attackers to manipulate a file-inclusion parameter and read local server files, with wp-config.php and other readable files as the primary exposure. The base CVSS vector is 8.1 with High Attack Complexity, but the independent assessment keeps the same unauthenticated and no-user-interaction prerequisites while bounding realistic impact to confidentiality-heavy local file disclosure with Low integrity and availability impact unless log poisoning or PHP wrappers enable escalation. No CISA KEV activity is identified in the provided data, and no public exploit identified at time of analysis; the independent assessment rates this as a credible but not top-tier priority.
PHP object injection in the Axiomthemes Balance WordPress theme (versions through 1.12.0) lets uncontrolled serialized data reach a PHP unserialize() call, enabling an attacker to instantiate arbitrary objects within the site's PHP process. Per the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), the flaw is remotely reachable without authentication or user interaction, but real-world impact is conditional on the presence of a usable POP gadget chain in the theme, WordPress core, or a co-installed plugin - absent such a gadget the injection can be inert. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-published fix version is present in the available intelligence; note that the publisher's CVSS vector rates complexity as low (base 9.8) whereas our assessment rates it high, so treat the maximal-impact framing with that caveat.
PHP object injection in the Axiomthemes Veto WordPress theme (all versions through 1.6.0) lets remote attackers hand untrusted serialized data to PHP's unserialize(), which can instantiate arbitrary classes if a usable gadget chain is reachable. The attack is network-reachable against a default theme install and, per the assessed vector (PR:N/UI:N), requires neither authentication nor user interaction, though the assessed attack complexity is High (AC:H) because exploitation depends on a POP chain being present in the theme, an installed plugin, or WordPress core. Practical impact is therefore conditional: the 9.8-style severity reflects worst-case object injection outcomes rather than a guaranteed code-execution path, and no public exploit has been identified at time of analysis. Note the affected product is a niche commercial theme, and no fixed version is stated in the available data.
PHP Object Injection in the AI ANN WordPress theme (by AxiomThemes) affects all versions up to and including 1.29.0, allowing unauthenticated remote attackers to inject crafted serialized PHP objects that are deserialized by the theme. When a suitable POP (property-oriented programming) gadget chain is present in the theme, WordPress core, or an active plugin, this can escalate to remote code execution, arbitrary file operations, or data compromise. Reported by Patchstack; no public exploit identified at time of analysis, though the CVSS 9.8 rating reflects the unauthenticated, network-reachable nature of the flaw.
PHP Object Injection in the Agricola WordPress theme (versions ≤ 1.21.0 by AxiomThemes) lets unauthenticated remote attackers inject crafted serialized PHP objects that are deserialized by the application, and with a suitable POP gadget chain this can escalate to arbitrary file operations, SQL manipulation, or remote code execution. Rated CVSS 9.8 and disclosed by Patchstack (EUVD-2026-53878), it requires no authentication or user interaction. No public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP Object Injection in the A.Williams (Alisha Williams) WordPress theme by AxiomThemes affects all versions up to and including 1.3.1, allowing remote unauthenticated attackers to inject crafted serialized PHP objects into an unsafe deserialization sink. When a suitable POP gadget chain is present in the theme or co-installed plugins, this can escalate to arbitrary file operations, SQL injection, or remote code execution. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; the 9.8 CVSS reflects theoretical worst-case impact rather than confirmed active exploitation.
Unauthenticated PHP Object Injection in the 69 Clothing WordPress theme (versions up to and including 1.2.11.1) lets remote attackers submit crafted serialized data that is unsafely deserialized, potentially triggering property-oriented programming (POP) gadget chains for code execution, data theft, or file manipulation. Reported by Patchstack and tracked as EUVD-2026-53989, it carries a critical CVSS 9.8 with no authentication required. There is no public exploit identified at time of analysis, but the network-reachable, unauthenticated nature makes it a high-priority patching target for any WordPress site running this theme.
Remote PHP object injection in the axiomthemes '777' (triple-seven) WordPress theme allows attackers to instantiate arbitrary PHP objects by supplying crafted serialized data to a vulnerable unserialize() call, affecting all versions up to and including 1.13.0. With the reported CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) scoring 9.8, an unauthenticated network attacker can achieve high-impact compromise if a usable POP gadget chain is present. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated local file inclusion in the Reprizo WordPress theme by AxiomThemes (versions 1.0.8 and earlier) allows remote attackers to coerce the PHP include/require chain into loading arbitrary server-side files, leading to disclosure of sensitive configuration data and potential code execution if uploaded or log files can be referenced. No public exploit identified at time of analysis, but the issue is tracked by Patchstack as a high-severity flaw against a commercial WordPress theme.
Unauthenticated local file inclusion in the Promo WordPress theme through version 1.3.0 allows remote attackers to coerce the application into including arbitrary PHP files from the server, potentially leading to source code disclosure, sensitive file reads, or remote code execution where attacker-controlled files are reachable. The vulnerability is reported by Patchstack and affects axiomthemes' Promo theme; no public exploit identified at time of analysis and EPSS data was not provided. The CVSS 3.1 base score of 8.1 reflects high impact across confidentiality, integrity, and availability despite high attack complexity.
A PHP object injection vulnerability exists in the Axiom Themes m2 | Construction and Tools Store theme through version 1.1.2, stemming from unsafe deserialization of untrusted data (CWE-502). This allows remote attackers to inject malicious serialized objects that can lead to arbitrary code execution or privilege escalation depending on available gadget chains in the WordPress environment. No CVSS score, EPSS data, or KEV status is currently available, but the vulnerability was reported by Patchstack and affects all installations running the vulnerable theme version.
Broken access control in the QuickCal Appointment Booking Calendar WordPress plugin (versions ≤ 1.0.16) allows authenticated users holding the Booking Agent role to bypass authorization checks and access functionality or data outside their intended privilege scope. The flaw, rooted in CWE-862 Missing Authorization, enables high-confidentiality and high-availability impact - suggesting attackers can both read sensitive booking/customer data and disrupt the scheduling service. No public exploit or CISA KEV listing is identified at time of analysis, though the Patchstack advisory confirms the issue.
Local file inclusion in the Axiomthemes Crafti WordPress theme (versions up to and including 1.12) allows remote unauthenticated attackers to coerce the PHP runtime into including arbitrary local files through improperly validated include/require parameters. Successful exploitation can lead to disclosure of sensitive server-side files, configuration data, and under certain conditions code execution via included content. No public exploit identified at time of analysis, but the issue is catalogued by Patchstack in their WordPress vulnerability database.
Local File Inclusion in Axiomthemes Confidant WordPress theme (versions up to and including 1.4) allows remote unauthenticated attackers to include arbitrary local PHP files on the server, potentially leading to sensitive information disclosure and code execution. The vulnerability is reported by Patchstack with a CVSS 8.1 (High) rating; no public exploit identified at time of analysis and the CVE is not present in CISA KEV. The high attack complexity (AC:H) suggests exploitation requires specific conditions to be met, despite the network-reachable, no-auth attack surface.
Local file inclusion in the Giardino WordPress theme (versions ≤1.1.10) allows unauthenticated attackers to read arbitrary files from the server, such as configuration files and source code. Exploitation requires high attack complexity and can lead to full system compromise if code execution is achieved through chaining. No active exploitation or public exploit has been identified, and the EPSS score is very low (0.08%).
Local file inclusion in axiomthemes Katelyn WordPress theme versions through 1.0.10 allows unauthenticated remote attackers to read arbitrary local files, potentially exposing sensitive data or leading to code execution. Exploitation does not require authentication but has high attack complexity, and no public exploit or active exploitation has been identified.
PHP Local File Inclusion in the Pinevale WordPress theme (<=1.0.14) allows unauthenticated attackers to include arbitrary local files on the server, potentially leading to remote code execution under high-complexity conditions. No active exploitation or public exploit has been identified, but the vulnerability carries a CVSS 8.1 score and affects all prior versions.
Local file inclusion in axiomthemes Renewal WordPress theme versions ≤1.2.2 allows unauthenticated attackers to read arbitrary local files by manipulating input to a PHP include/require statement. Successful exploitation could expose sensitive data such as wp-config.php credentials, with potential limited code execution via log poisoning. EPSS indicates very low exploitation probability (0.08%), and no active exploitation or public proof-of-concept is currently known.
Local file inclusion in the Rosalinda WordPress theme ≤1.2.3 permits unauthenticated attackers to arbitrarily include local files, leading to information disclosure and potential remote code execution. The vulnerability is rated high severity (CVSS 8.1) but has low exploitation likelihood (EPSS 0.08%), and there is no evidence of active exploitation or public exploit code at this time.
Unauthenticated Local File Inclusion in the Panda WordPress theme up to version 1.21 allows remote attackers to read arbitrary server files and potentially escalate to code execution. The vulnerability is not known to be actively exploited and has an EPSS score of 0.08%, indicating low real-world exploitation probability at this time.
Local file inclusion in the Soleil WordPress theme (versions through 1.17) allows unauthenticated attackers to include arbitrary local files via a network request, potentially exposing sensitive data or enabling remote code execution. Exploitation requires high attack complexity, and no active exploitation or public proof-of-concept is currently known.
Local file inclusion in the Tripster WordPress theme (versions <= 1.0.10) allows unauthenticated attackers to read and execute arbitrary files on the server, potentially
Local file inclusion in the Ipharm WordPress theme (versions up to 1.2.3) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving code execution. No public exploit or active exploitation is known, and EPSS probability is very low (0.08%), though the CVSS score of 8.1 indicates high potential impact.
Local file inclusion in the AxiomThemes HeartStar WordPress theme permits unauthenticated attackers to include arbitrary local files, potentially leading to remote code execution or full site compromise. The vulnerability affects versions up to and including 1.0.14. While there is no confirmed active exploitation or public exploit code, the EPSS score of 0.08% suggests a very low exploitation probability.
Local File Inclusion (LFI) in axiomthemes Lione WordPress theme versions up to 1.16 allows unauthenticated remote attackers to include arbitrary local files via a crafted request. Successful exploitation can lead to sensitive data exposure and, if combined with other attack vectors such as file uploads, remote code execution. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently known; EPSS indicates a low probability of exploitation (0.08%).
Local file inclusion in axiomthemes Spock WordPress theme through version 1.17 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive information. While high complexity limits exploitability, successful exploitation could lead to full system compromise via techniques like log poisoning. No public exploit code or active exploitation has been reported, and EPSS indicates a very low likelihood of real-world attacks.
Local file inclusion in the Aromatica WordPress theme (versions <= 1.8) allows unauthenticated attackers to read arbitrary files on the server, potentially leading to sensitive information disclosure or remote code execution if combined with other techniques. The vulnerability is not known to be actively exploited, with a low exploitation probability (EPSS 0.08%).
Local file inclusion in axiomthemes Athos WordPress theme up to version 1.9 allows unauthenticated attackers to include arbitrary local files, potentially achieving remote code execution and full site compromise. Exploitation requires high attack complexity, and while no public exploit or active exploitation is currently known, the impact is critical if successfully leveraged.
Local file inclusion in axiomthemes Vocal WordPress theme versions up to 1.12 allows unauthenticated attackers to read arbitrary files on the server by manipulating file path parameters in PHP include/require statements. No active exploitation or public exploit code has been reported; EPSS score is very low (0.08%), indicating minimal immediate risk.
Local file inclusion in the EcoGrow WordPress theme (up to version 1.7) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive configuration data like wp-config.php. While no active exploitation or public exploit code is known, the high CVSS score reflects possible escalation to full server compromise if the PHP environment supports wrapper-based code execution. The low EPSS score (0.08%) suggests very limited exploitation likelihood at this time.
Local file inclusion in the Manufactory WordPress theme (<=1.4) allows unauthenticated attackers to read arbitrary files from the server. While the CVSS 8.1 indicates high severity, EPSS exploitation probability is low (0.08%) and no public exploit or active exploitation has been identified.
Local file inclusion in the Agricola WordPress theme (version 1.1.0 and below) allows unauthenticated remote attackers to include arbitrary local files, potentially leading to information disclosure and remote code execution if combined with PHP code injection into a readable file. The vulnerability has a high CVSS score (8.1) but is not known to be actively exploited, and EPSS predicts a very low (0.08%) chance of exploitation.
Local file inclusion in Dwell theme for WordPress versions ≤1.7.0 allows remote unauthenticated attackers to read arbitrary files on the server. The vulnerability, identified by Patchstack, carries a CVSS 8.1 but has very low EPSS exploitation probability and no known public exploit or active targeting. Successful exploitation could lead to full compromise if sensitive files are exfiltrated.
Local file inclusion in the Fabric WordPress theme (≤1.5.0) allows unauthenticated attackers to include arbitrary PHP files, leading to potential remote code execution or sensitive data exposure. Exploitation requires high attack complexity, and no public exploit or active exploitation (KEV) has been reported, with EPSS indicating a 0.08% probability of widespread use.
Local file inclusion in the Basil WordPress theme (up to version 1.3.12) allows unauthenticated remote attackers to read arbitrary files from the server. The vulnerability has a CVSS score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) but a very low EPSS probability (0.08%), and no active exploitation or public exploit code has been detected.
Local file inclusion in the Tacticool WordPress theme through version 1.0.13 allows unauthenticated attackers to include arbitrary local files, potentially disclosing sensitive information or executing code. Exploitation requires high attack complexity, and no public exploit or active exploitation is currently reported.
Local file inclusion in the Catamaran WordPress theme up to version 1.15 lets unauthenticated remote attackers read arbitrary server files and, in certain configurations, escalate to full code execution. The vulnerability stems from improper filename control in a PHP include/require statement, exposing websites using the theme to data theft and server compromise. No active exploitation or public exploit code is known, and EPSS probability is low (0.08%).
Local file inclusion in the Lunna WordPress theme (versions ≤1.15) permits unauthenticated remote attackers to include arbitrary local files, leading to sensitive data exposure and potential remote code execution. The vulnerability carries a CVSS score of 8.1, but exploitation requires high attack complexity and has an EPSS probability of just 0.08%, making widespread automated attack improbable.
Local file inclusion in The Gig WordPress theme <=1.18.0 allows unauthenticated attackers to read arbitrary files from the server and potentially escalate to code execution. The flaw arises from improper sanitization of filenames passed to PHP include/require statements, enabling path traversal. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.
Local file inclusion in the Anubis WordPress theme up to version 1.25 allows unauthenticated remote attackers to read arbitrary files on the server, potentially exposing sensitive configuration data. Successful exploitation can lead to full compromise if combined with other vulnerabilities, though attack complexity is high. No active exploitation or public exploit code has been reported, and EPSS indicates low likelihood of widespread exploitation.
PHP Local File Inclusion in the axiomthemes Prisma WordPress theme (all versions through 1.10) lets remote unauthenticated attackers coerce the application into including arbitrary local files, exposing sensitive data and potentially achieving code execution via included PHP payloads. Reported by Patchstack, the flaw carries a CVSS 8.1 (high) rating but a low EPSS of 0.08% (23rd percentile), and there is no public exploit identified at time of analysis. Not listed in CISA KEV.
Local File Inclusion in axiomthemes Palatio WordPress theme through version 1.6 allows unauthenticated remote attackers to include arbitrary local files on the server, potentially leading to information disclosure and code execution. The vulnerability has high attack complexity and no user interaction; it has not been observed in active exploitation, and no public exploit code has been identified at time of analysis.
Remote unauthenticated local file inclusion in the FitFlex WordPress theme (version up to 1.6) allows attackers to read arbitrary server-side files, potentially exposing configuration data, credentials, or enabling further exploitation. The vulnerability carries a high CVSS score (8.1) but EPSS prediction is low (0.08%), and no public exploit or active exploitation is confirmed at the time of analysis.
Local File Inclusion in the Pantry WordPress theme through version 1.4 allows unauthenticated attackers to include arbitrary local files, leading to full site compromise – including information disclosure, arbitrary code execution, and complete integrity and availability loss. The vulnerability carries a CVSS base score of 8.1 but has a very low EPSS exploitation probability (0.08%); no active exploitation or public exploit code has been identified at this time.
Local file inclusion in the Good Mood WordPress theme (versions up to 1.16) allows unauthenticated attackers to read arbitrary files from the server, with potential for remote code execution if server configuration permits remote file inclusion. No active exploitation or public exploit code has been identified at this time, but the CVSS 8.1 score reflects high potential impact.
Local file inclusion in the Alright WordPress theme (up to version 1.6.1) allows unauthenticated attackers to read arbitrary local files. Exploitation complexity is high (CVSS 8.1), and no public exploit or active exploitation has been identified at time of analysis, but EPSS is low (0.08%).
Local file inclusion (LFI) in the Axiomthemes Towny WordPress theme <= 1.16 allows unauthenticated attackers to read arbitrary local files on the server, potentially exposing credentials or other sensitive data. The vulnerability has a CVSS base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicating high impact but elevated attack complexity, and an EPSS score of 0.08% suggesting very low likelihood of widespread exploitation. No active exploitation or public proof-of-concept code has been identified at this time.
Local file inclusion in the Algenix WordPress theme through version 1.0 allows remote, unauthenticated attackers to read arbitrary files on the server. Exploitation requires high attack complexity, likely due to path traversal constraints or the need to chain with other conditions. No active exploitation or public proof-of-concept is confirmed, and the EPSS risk is very low (0.08%).
PHP Local File Inclusion in the Hygia WordPress theme up to version 1.16 allows unauthenticated remote attackers to read arbitrary local files on the server, potentially compromising credentials or enabling further attacks. Exploitation complexity is high (CVSS AC:H), and no active exploitation or public exploit code has been identified at this time. The EPSS score is low (0.08%), indicating a low likelihood of widespread exploitation.
SQL injection in axiomthemes smartSEO WordPress theme versions up to 4.0 enables authenticated attackers to extract sensitive database information and potentially cause service disruption. Exploitation requires low-privilege authenticated access but can impact resources beyond the vulnerable component (scope change). EPSS score of 0.05% indicates low observed exploitation probability, with no CISA KEV listing or public POC identified at time of analysis.
Critical deserialization of untrusted data vulnerability in Axiomthemes Sweet Dessert that enables object injection attacks. The vulnerability affects Sweet Dessert versions before 1.1.13 and allows remote attackers to inject malicious serialized objects without authentication, potentially achieving remote code execution with complete system compromise. With a CVSS score of 9.8 and network-based attack vector requiring no user interaction or privileges, this represents a critical internet-exposed risk.