Marcell
Monthly
Unauthenticated PHP object injection in the ThemeRex Marcell WordPress theme through version 1.2.14 allows remote attackers to supply attacker-controlled serialized data to a PHP deserialization path, with a CVSS 3.1 score of 9.8 and CWE-502. The CVSS vector indicates remote, low-complexity, unauthenticated exploitation with no user interaction, and the vuln.today priority decision is act_now. No public exploit was identified at time of analysis, and the practical impact depends on whether a reachable POP gadget chain exists in the theme or installed plugins; the trigger endpoint or parameter is not described in the available sources.
Unauthenticated PHP object injection in the ThemeRex Marcell WordPress theme through version 1.2.14 allows remote attackers to supply attacker-controlled serialized data to a PHP deserialization path, with a CVSS 3.1 score of 9.8 and CWE-502. The CVSS vector indicates remote, low-complexity, unauthenticated exploitation with no user interaction, and the vuln.today priority decision is act_now. No public exploit was identified at time of analysis, and the practical impact depends on whether a reachable POP gadget chain exists in the theme or installed plugins; the trigger endpoint or parameter is not described in the available sources.