Gamezone
Monthly
Unauthenticated PHP object injection in the ThemeREX Gamezone WordPress theme through version 1.1.11 can let remote attackers influence deserialization on sites where the vulnerable theme is active, with the supplied CVSS vector indicating high confidentiality, integrity, and availability impact. Exploitation requires Gamezone to be installed and active, and the available sources do not describe the trigger or confirm a usable POP gadget chain, so realized impact may be narrower than the 9.8 base score. No public exploit identified at time of analysis, but the intelligence decision label is act_now.
Unauthenticated PHP object injection in the ThemeREX Gamezone WordPress theme through version 1.1.11 can let remote attackers influence deserialization on sites where the vulnerable theme is active, with the supplied CVSS vector indicating high confidentiality, integrity, and availability impact. Exploitation requires Gamezone to be installed and active, and the available sources do not describe the trigger or confirm a usable POP gadget chain, so realized impact may be narrower than the 9.8 base score. No public exploit identified at time of analysis, but the intelligence decision label is act_now.