Dwell
Monthly
PHP object injection in the ThemeREX Group Dwell WordPress theme (versions up to and including 1.16.0) allows unauthenticated remote attackers to send crafted serialized data to an unserialize() sink, which can lead to file deletion, SQL injection, or remote code execution if a usable POP gadget chain exists in the site's installed theme, plugins, or WordPress core. The published CVSS score is 9.8, but independent assessment rates attack complexity as high because real-world impact depends entirely on gadget-chain availability in the specific deployment; no public exploit code or confirmed active exploitation was identified at time of analysis. This is a WordPress theme vulnerability reported by Patchstack and tracked as EUVD-2026-96188.
Local file inclusion in Dwell theme for WordPress versions ≤1.7.0 allows remote unauthenticated attackers to read arbitrary files on the server. The vulnerability, identified by Patchstack, carries a CVSS 8.1 but has very low EPSS exploitation probability and no known public exploit or active targeting. Successful exploitation could lead to full compromise if sensitive files are exfiltrated.
PHP object injection in the ThemeREX Group Dwell WordPress theme (versions up to and including 1.16.0) allows unauthenticated remote attackers to send crafted serialized data to an unserialize() sink, which can lead to file deletion, SQL injection, or remote code execution if a usable POP gadget chain exists in the site's installed theme, plugins, or WordPress core. The published CVSS score is 9.8, but independent assessment rates attack complexity as high because real-world impact depends entirely on gadget-chain availability in the specific deployment; no public exploit code or confirmed active exploitation was identified at time of analysis. This is a WordPress theme vulnerability reported by Patchstack and tracked as EUVD-2026-96188.
Local file inclusion in Dwell theme for WordPress versions ≤1.7.0 allows remote unauthenticated attackers to read arbitrary files on the server. The vulnerability, identified by Patchstack, carries a CVSS 8.1 but has very low EPSS exploitation probability and no known public exploit or active targeting. Successful exploitation could lead to full compromise if sensitive files are exfiltrated.