Bonbon
Monthly
PHP object injection in the ThemeRex Bonbon WordPress theme through version 1.11 is reachable without authentication or user interaction, and the supplied CVSS 3.1 vector rates it 9.8 with high confidentiality, integrity, and availability impact. The practical impact depends on a usable gadget chain in the theme, WordPress core, or a co-installed plugin; the deserialization entry point and whether a working gadget chain is publicly available are not described in the available sources. No public exploit was identified in the supplied data at time of analysis, no fixed version is stated, and the vuln.today decision label is act_now.
PHP object injection in the ThemeRex Bonbon WordPress theme through version 1.11 is reachable without authentication or user interaction, and the supplied CVSS 3.1 vector rates it 9.8 with high confidentiality, integrity, and availability impact. The practical impact depends on a usable gadget chain in the theme, WordPress core, or a co-installed plugin; the deserialization entry point and whether a working gadget chain is publicly available are not described in the available sources. No public exploit was identified in the supplied data at time of analysis, no fixed version is stated, and the vuln.today decision label is act_now.