Drone Media
Monthly
Unauthenticated PHP object injection in the Ancorathemes Drone Media WordPress theme, affecting all versions through 2.2.0, lets a remote attacker supply a crafted serialized PHP object to a theme-reachable sink without authentication, no user interaction, and low attack complexity, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N base vector scored 9.8. Because successful exploitation depends on a usable property-oriented programming (POP) gadget chain being present in the theme, WordPress core, or an installed plugin, the maximum C:H/I:H/A:H impact - typically code execution, file manipulation, or full site takeover - is only realized when such a chain exists; otherwise the realized impact may be lower. At time of analysis there was no public exploit code identified and no evidence of confirmed active exploitation (not listed in CISA KEV), though the combination of an unauthenticated, network-reachable, low-complexity injection sink makes this a high-priority target for attackers once a chain is publicized. Reported by Patchstack against the CPE cpe:2.3:a:ancorathemes:drone_media.
Unauthenticated PHP object injection in the Ancorathemes Drone Media WordPress theme, affecting all versions through 2.2.0, lets a remote attacker supply a crafted serialized PHP object to a theme-reachable sink without authentication, no user interaction, and low attack complexity, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N base vector scored 9.8. Because successful exploitation depends on a usable property-oriented programming (POP) gadget chain being present in the theme, WordPress core, or an installed plugin, the maximum C:H/I:H/A:H impact - typically code execution, file manipulation, or full site takeover - is only realized when such a chain exists; otherwise the realized impact may be lower. At time of analysis there was no public exploit code identified and no evidence of confirmed active exploitation (not listed in CISA KEV), though the combination of an unauthenticated, network-reachable, low-complexity injection sink makes this a high-priority target for attackers once a chain is publicized. Reported by Patchstack against the CPE cpe:2.3:a:ancorathemes:drone_media.