Equadio
Monthly
Unauthenticated PHP object injection in the ThemeRex Equadio WordPress theme (versions up to and including 1.1.4) allows remote attackers to supply crafted serialized input to vulnerable deserialization entry points, potentially leading to remote code execution, file deletion, or other high-impact outcomes depending on available gadget chains. The flaw carries a CVSS 3.1 base score of 9.8, reflecting network exploitability with low complexity, no authentication, and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, though the severity and ease of exploitation make prompt patching critical.
Unauthenticated PHP object injection in the ThemeRex Equadio WordPress theme (versions up to and including 1.1.4) allows remote attackers to supply crafted serialized input to vulnerable deserialization entry points, potentially leading to remote code execution, file deletion, or other high-impact outcomes depending on available gadget chains. The flaw carries a CVSS 3.1 base score of 9.8, reflecting network exploitability with low complexity, no authentication, and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, though the severity and ease of exploitation make prompt patching critical.