Let S Play
Monthly
Unauthenticated PHP object injection in the ThemeREX Let's Play (playhockey) WordPress theme, versions through 1.1.15, allows remote attackers to pass crafted serialized data to an unserialize() call inside the theme, which can trigger object injection and may escalate to code execution, data theft, or full site compromise when a usable POP gadget chain is reachable. No vendor-released fixed version was identified and no public exploit code was identified at time of analysis. Exploitation is assessed as requiring a viable property-oriented programming gadget chain in the theme, installed plugins, or WordPress core, so the practical attack complexity is raised to High even though the attack surface remains network-reachable and unauthenticated.
Unauthenticated PHP object injection in the ThemeREX Let's Play (playhockey) WordPress theme, versions through 1.1.15, allows remote attackers to pass crafted serialized data to an unserialize() call inside the theme, which can trigger object injection and may escalate to code execution, data theft, or full site compromise when a usable POP gadget chain is reachable. No vendor-released fixed version was identified and no public exploit code was identified at time of analysis. Exploitation is assessed as requiring a viable property-oriented programming gadget chain in the theme, installed plugins, or WordPress core, so the practical attack complexity is raised to High even though the attack surface remains network-reachable and unauthenticated.