Filmax
Monthly
Unauthenticated PHP Object Injection in the Filmax WordPress theme through version 1.1.11 lets remote attackers reach deserialization logic without credentials or user interaction, carrying a 9.8 Critical CVSS score and an act_now priority from vuln.today. Impact is full confidentiality, integrity and availability loss per the assessed vector, although real-world damage depends on a usable POP gadget chain being reachable through the theme, an active plugin, or WordPress core; the available sources do not describe the injection vector or confirm such a chain, so the trigger is not described in the available sources. No public exploit code or active exploitation is confirmed at time of analysis, and the only supplied reference is Patchstack's vulnerability entry for the theme.
Unauthenticated PHP Object Injection in the Filmax WordPress theme through version 1.1.11 lets remote attackers reach deserialization logic without credentials or user interaction, carrying a 9.8 Critical CVSS score and an act_now priority from vuln.today. Impact is full confidentiality, integrity and availability loss per the assessed vector, although real-world damage depends on a usable POP gadget chain being reachable through the theme, an active plugin, or WordPress core; the available sources do not describe the injection vector or confirm such a chain, so the trigger is not described in the available sources. No public exploit code or active exploitation is confirmed at time of analysis, and the only supplied reference is Patchstack's vulnerability entry for the theme.