Emojination
Monthly
Unauthenticated PHP object injection in the ThemeRex EmojiNation WordPress theme through version 1.0.12 allows remote attackers to pass crafted serialized input into a reachable theme endpoint, scored 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and rated act_now by vuln.today priority. Success depends on whether an exploitable PHP gadget chain is loaded via the theme, an active plugin, or WordPress core; without a usable chain the practical result may be limited to a crash or be non-exploitable, and the vulnerable parameter and trigger are not described in the available sources. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, and the reporting rests on a single source (Patchstack).
Unauthenticated PHP object injection in the ThemeRex EmojiNation WordPress theme through version 1.0.12 allows remote attackers to pass crafted serialized input into a reachable theme endpoint, scored 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and rated act_now by vuln.today priority. Success depends on whether an exploitable PHP gadget chain is loaded via the theme, an active plugin, or WordPress core; without a usable chain the practical result may be limited to a crash or be non-exploitable, and the vulnerable parameter and trigger are not described in the available sources. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, and the reporting rests on a single source (Patchstack).