Hotlock
Monthly
PHP object injection in the ThemeREX Group HotLock WordPress theme through version 1.3.9 can let an attacker who reaches a deserialization sink supply serialized data that instantiates arbitrary PHP objects, with severe confidentiality, integrity and availability impact if a usable gadget chain is loadable. The CVSS vector rates the issue 9.8 with network reachability, no required privileges and no user interaction, although the specific vulnerable feature or parameter is not described in the provided sources and the unauthenticated path should be confirmed against the Patchstack advisory. No public exploit was identified at time of analysis, and the act_now priority rests on limited sourcing rather than confirmed exploitation.
PHP object injection in the ThemeREX Group HotLock WordPress theme through version 1.3.9 can let an attacker who reaches a deserialization sink supply serialized data that instantiates arbitrary PHP objects, with severe confidentiality, integrity and availability impact if a usable gadget chain is loadable. The CVSS vector rates the issue 9.8 with network reachability, no required privileges and no user interaction, although the specific vulnerable feature or parameter is not described in the provided sources and the unauthenticated path should be confirmed against the Patchstack advisory. No public exploit was identified at time of analysis, and the act_now priority rests on limited sourcing rather than confirmed exploitation.