Gunslinger
Monthly
Gunslinger WordPress theme through version 1.11 exposes an unauthenticated PHP object injection issue that can let remote attackers supply serialized input to a PHP object deserialization path, carrying high confidentiality, integrity, and availability impact if a usable gadget chain is present. The CVSS vector confirms network reachability with no privileges or user interaction, but the exact vulnerable parameter or endpoint is not described in the available sources. No public exploit is identified at time of analysis, no fixed version is stated, and the vuln.today decision label is act_now.
Unauthenticated local file inclusion in the ThemeRex Gunslinger WordPress theme through version 1.7 allows remote attackers to coerce PHP into including arbitrary files from the server filesystem, leading to disclosure of sensitive files and potential remote code execution where attacker-influenced content can be staged. No public exploit identified at time of analysis, but the flaw is reachable without authentication and affects all installations running version 1.7 or earlier of the theme.
Gunslinger WordPress theme through version 1.11 exposes an unauthenticated PHP object injection issue that can let remote attackers supply serialized input to a PHP object deserialization path, carrying high confidentiality, integrity, and availability impact if a usable gadget chain is present. The CVSS vector confirms network reachability with no privileges or user interaction, but the exact vulnerable parameter or endpoint is not described in the available sources. No public exploit is identified at time of analysis, no fixed version is stated, and the vuln.today decision label is act_now.
Unauthenticated local file inclusion in the ThemeRex Gunslinger WordPress theme through version 1.7 allows remote attackers to coerce PHP into including arbitrary files from the server filesystem, leading to disclosure of sensitive files and potential remote code execution where attacker-influenced content can be staged. No public exploit identified at time of analysis, but the flaw is reachable without authentication and affects all installations running version 1.7 or earlier of the theme.