Good Homes
Monthly
Unauthenticated PHP object injection in the ThemeRex Good Homes WordPress theme through version 1.3.13 can allow remote attackers to supply serialized data that may cause high confidentiality, integrity, and availability impact if a usable POP gadget chain exists in the theme, an installed plugin, or WordPress core. The CVSS 3.1 score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and vuln.today assigns an act_now priority. The provided data does not identify public exploit code or confirm CISA KEV active exploitation, and it does not confirm that a usable gadget chain or the specific vulnerable input is present.
A Local File Inclusion (LFI) vulnerability exists in the ThemeREX Good Homes WordPress theme through version 1.3.13, allowing attackers to include and execute arbitrary local files on the affected server. The vulnerability stems from improper control of filenames in PHP include/require statements (CWE-98), enabling unauthenticated attackers to disclose sensitive information or achieve remote code execution by accessing system files. No CVSS score, EPSS data, or active KEV designation was reported, but the LFI classification and information disclosure impact indicate this requires prompt patching.
Unauthenticated PHP object injection in the ThemeRex Good Homes WordPress theme through version 1.3.13 can allow remote attackers to supply serialized data that may cause high confidentiality, integrity, and availability impact if a usable POP gadget chain exists in the theme, an installed plugin, or WordPress core. The CVSS 3.1 score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and vuln.today assigns an act_now priority. The provided data does not identify public exploit code or confirm CISA KEV active exploitation, and it does not confirm that a usable gadget chain or the specific vulnerable input is present.
A Local File Inclusion (LFI) vulnerability exists in the ThemeREX Good Homes WordPress theme through version 1.3.13, allowing attackers to include and execute arbitrary local files on the affected server. The vulnerability stems from improper control of filenames in PHP include/require statements (CWE-98), enabling unauthenticated attackers to disclose sensitive information or achieve remote code execution by accessing system files. No CVSS score, EPSS data, or active KEV designation was reported, but the LFI classification and information disclosure impact indicate this requires prompt patching.