Ipharm
Monthly
PHP object injection in the IPharm WordPress theme through version 1.2.4 can allow remote attackers to pass crafted serialized data into a PHP unserialize() path, potentially enabling object injection and, if a usable gadget chain exists in the theme, WordPress core, or installed plugins, full site compromise. The assigned CVSS score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but the independent assessment adjusts attack complexity to high because the specific vulnerable input vector is not identified and practical impact depends on gadget-chain availability. No public exploit was identified at time of analysis, and no CISA KEV confirmation was provided; authentication requirements from the CVSS vector are PR:N, but unauthenticated reachability is not independently verifiable from the available data.
Local file inclusion in the Ipharm WordPress theme (versions up to 1.2.3) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving code execution. No public exploit or active exploitation is known, and EPSS probability is very low (0.08%), though the CVSS score of 8.1 indicates high potential impact.
PHP object injection in the IPharm WordPress theme through version 1.2.4 can allow remote attackers to pass crafted serialized data into a PHP unserialize() path, potentially enabling object injection and, if a usable gadget chain exists in the theme, WordPress core, or installed plugins, full site compromise. The assigned CVSS score is 9.8 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, but the independent assessment adjusts attack complexity to high because the specific vulnerable input vector is not identified and practical impact depends on gadget-chain availability. No public exploit was identified at time of analysis, and no CISA KEV confirmation was provided; authentication requirements from the CVSS vector are PR:N, but unauthenticated reachability is not independently verifiable from the available data.
Local file inclusion in the Ipharm WordPress theme (versions up to 1.2.3) allows unauthenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving code execution. No public exploit or active exploitation is known, and EPSS probability is very low (0.08%), though the CVSS score of 8.1 indicates high potential impact.