Edge Decor
Monthly
Unauthenticated PHP object injection in the ThemeRex Edge Decor WordPress theme through version 2.9 can let remote attackers feed crafted serialized data into PHP object deserialization on affected sites. The issue carries CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and an act_now priority label, but impact beyond object injection depends on a usable POP gadget chain in the theme, plugins, or WordPress core. Only sites with this specific theme installed and active are exposed, and the provided intelligence contains no KEV status or public exploit reference; no public exploit was identified at time of analysis.
Unauthenticated PHP object injection in the ThemeRex Edge Decor WordPress theme through version 2.9 can let remote attackers feed crafted serialized data into PHP object deserialization on affected sites. The issue carries CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) and an act_now priority label, but impact beyond object injection depends on a usable POP gadget chain in the theme, plugins, or WordPress core. Only sites with this specific theme installed and active are exposed, and the provided intelligence contains no KEV status or public exploit reference; no public exploit was identified at time of analysis.