Gamic
Monthly
Unauthenticated PHP object injection in the ThemeREX Gamic WordPress theme through version 1.19 lets remote attackers supply crafted serialized input to a deserialization sink, and the CVSS 9.8 vector indicates high confidentiality, integrity, and availability impact. The vulnerability class is CWE-502; full code-execution impact depends on a usable PHP gadget chain, and the specific vulnerable parameter or endpoint is not described in the available sources. The provided intelligence has no CISA KEV listing or public exploit identified at time of analysis, while the vuln.today decision label is act_now.
Local file inclusion in the ThemeRex Gamic WordPress theme versions 1.15 and earlier allows unauthenticated remote attackers to coerce the PHP application into including arbitrary files via crafted parameters. Successful exploitation can expose sensitive configuration data (including wp-config.php) and, depending on server configuration, may escalate to remote code execution through log poisoning or session-file inclusion. No public exploit identified at time of analysis, and the issue has not been listed in CISA KEV.
Unauthenticated PHP object injection in the ThemeREX Gamic WordPress theme through version 1.19 lets remote attackers supply crafted serialized input to a deserialization sink, and the CVSS 9.8 vector indicates high confidentiality, integrity, and availability impact. The vulnerability class is CWE-502; full code-execution impact depends on a usable PHP gadget chain, and the specific vulnerable parameter or endpoint is not described in the available sources. The provided intelligence has no CISA KEV listing or public exploit identified at time of analysis, while the vuln.today decision label is act_now.
Local file inclusion in the ThemeRex Gamic WordPress theme versions 1.15 and earlier allows unauthenticated remote attackers to coerce the PHP application into including arbitrary files via crafted parameters. Successful exploitation can expose sensitive configuration data (including wp-config.php) and, depending on server configuration, may escalate to remote code execution through log poisoning or session-file inclusion. No public exploit identified at time of analysis, and the issue has not been listed in CISA KEV.