Helion
Monthly
Unauthenticated PHP object injection in the ThemeREX Helion WordPress theme, affecting versions up to and including 1.1.12, carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is rated for remediation this week. Because the vector is PR:N and UI:N, any remote attacker who can reach the theme's vulnerable deserialization path needs neither credentials nor victim interaction, though the AC:H rating reflects that the high confidentiality, integrity and availability impact depends on a usable PHP gadget chain being present in the theme, an installed plugin, or WordPress core - a condition the available sources do not confirm. The specific feature, endpoint or parameter that performs the unsafe deserialization is not described in the available sources, and no public exploit code or active exploitation is identified in the available intelligence. Sites are exposed only where the vulnerable Helion theme is installed and active at version 1.1.12 or earlier.
Unauthenticated PHP object injection in the ThemeREX Helion WordPress theme, affecting versions up to and including 1.1.12, carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is rated for remediation this week. Because the vector is PR:N and UI:N, any remote attacker who can reach the theme's vulnerable deserialization path needs neither credentials nor victim interaction, though the AC:H rating reflects that the high confidentiality, integrity and availability impact depends on a usable PHP gadget chain being present in the theme, an installed plugin, or WordPress core - a condition the available sources do not confirm. The specific feature, endpoint or parameter that performs the unsafe deserialization is not described in the available sources, and no public exploit code or active exploitation is identified in the available intelligence. Sites are exposed only where the vulnerable Helion theme is installed and active at version 1.1.12 or earlier.