Coinpress
Monthly
Unauthenticated PHP object injection in the Coinpress WordPress theme through version 1.0.15 allows remote attackers to pass crafted serialized data to the theme, with the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicating full confidentiality, integrity, and availability impact and no authentication or user interaction requirement. The vuln.today Decision label is act_now and the finding is reported by Patchstack, but the available sources do not name the vulnerable parameter or endpoint and do not confirm a reachable POP gadget chain, so file-write or code-execution impact is conditional on such a chain existing in the theme, co-installed plugins, or WordPress core. No public exploit is identified in the supplied data.
Unauthenticated PHP object injection in the Coinpress WordPress theme through version 1.0.15 allows remote attackers to pass crafted serialized data to the theme, with the supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) indicating full confidentiality, integrity, and availability impact and no authentication or user interaction requirement. The vuln.today Decision label is act_now and the finding is reported by Patchstack, but the available sources do not name the vulnerable parameter or endpoint and do not confirm a reachable POP gadget chain, so file-write or code-execution impact is conditional on such a chain existing in the theme, co-installed plugins, or WordPress core. No public exploit is identified in the supplied data.