Holistic Center
Monthly
PHP object injection in the axiomthemes Holistic Center WordPress theme through 1.2.6 exposes a deserialization path for attacker-controlled serialized input, and the input assigns CVSS 9.8 with an act_now priority. The independent assessment records AC:H because concrete impact depends on a usable POP or magic-method gadget chain in the theme, WordPress core, or co-installed plugins, and the supplied sources do not identify the vulnerable sink, exact trigger, or a working chain. No public exploit is identified at time of analysis, and exposure is limited to sites running this theme at an affected version.
PHP object injection in the axiomthemes Holistic Center WordPress theme through 1.2.6 exposes a deserialization path for attacker-controlled serialized input, and the input assigns CVSS 9.8 with an act_now priority. The independent assessment records AC:H because concrete impact depends on a usable POP or magic-method gadget chain in the theme, WordPress core, or co-installed plugins, and the supplied sources do not identify the vulnerable sink, exact trigger, or a working chain. No public exploit is identified at time of analysis, and exposure is limited to sites running this theme at an affected version.