Hygia
Monthly
PHP object injection in the ThemeREX Hygia WordPress theme (versions through 1.21.0) lets unauthenticated remote attackers pass crafted serialized data into an unsafe PHP deserialization call, which can lead to full compromise of confidentiality, integrity, and availability on any site running the affected theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) confirms the attack is network-reachable with no authentication and no user interaction, making every site with an active vulnerable Hygia install a candidate target. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though the practical ceiling of the attack depends on whether a usable POP gadget chain exists in the theme, WordPress core, or another installed plugin.
PHP Local File Inclusion in the Hygia WordPress theme up to version 1.16 allows unauthenticated remote attackers to read arbitrary local files on the server, potentially compromising credentials or enabling further attacks. Exploitation complexity is high (CVSS AC:H), and no active exploitation or public exploit code has been identified at this time. The EPSS score is low (0.08%), indicating a low likelihood of widespread exploitation.
PHP object injection in the ThemeREX Hygia WordPress theme (versions through 1.21.0) lets unauthenticated remote attackers pass crafted serialized data into an unsafe PHP deserialization call, which can lead to full compromise of confidentiality, integrity, and availability on any site running the affected theme. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8) confirms the attack is network-reachable with no authentication and no user interaction, making every site with an active vulnerable Hygia install a candidate target. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though the practical ceiling of the attack depends on whether a usable POP gadget chain exists in the theme, WordPress core, or another installed plugin.
PHP Local File Inclusion in the Hygia WordPress theme up to version 1.16 allows unauthenticated remote attackers to read arbitrary local files on the server, potentially compromising credentials or enabling further attacks. Exploitation complexity is high (CVSS AC:H), and no active exploitation or public exploit code has been identified at this time. The EPSS score is low (0.08%), indicating a low likelihood of widespread exploitation.