Greeny
Monthly
PHP object injection in the Greeny WordPress theme (ThemeREX Group) through version 2.10.0 allows remote attackers to feed crafted serialized data into an unsafe PHP unserialize() call, leading to arbitrary object instantiation and - where a usable POP gadget chain exists in the theme, WordPress core, or another active plugin - code execution or full site compromise. The published scoring rates this 9.8 with network vector, no privileges (PR:N), and no user interaction (UI:N), but the specific vulnerable endpoint and whether authentication is genuinely required are not confirmed by the available data, and our independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) precisely because exploitation hinges on a gadget chain being present rather than on the injection alone. There is no public exploit identified at time of analysis and no CISA KEV listing for this issue.
PHP object injection in the Greeny WordPress theme (ThemeREX Group) through version 2.10.0 allows remote attackers to feed crafted serialized data into an unsafe PHP unserialize() call, leading to arbitrary object instantiation and - where a usable POP gadget chain exists in the theme, WordPress core, or another active plugin - code execution or full site compromise. The published scoring rates this 9.8 with network vector, no privileges (PR:N), and no user interaction (UI:N), but the specific vulnerable endpoint and whether authentication is genuinely required are not confirmed by the available data, and our independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) precisely because exploitation hinges on a gadget chain being present rather than on the injection alone. There is no public exploit identified at time of analysis and no CISA KEV listing for this issue.