Meals Wheels
Monthly
PHP object injection in ThemeRex's Meals & Wheels theme through version 1.1.13 is remotely reachable without authentication or user interaction and is rated 9.8 CVSS. The entry point and trigger are not described in the available sources, and real-world impact depends on a reachable POP gadget chain that the evidence does not confirm; no public exploit was identified at time of analysis. Patchstack reported the flaw, and no fixed version is listed in the provided evidence.
PHP object injection in ThemeRex's Meals & Wheels theme through version 1.1.13 is remotely reachable without authentication or user interaction and is rated 9.8 CVSS. The entry point and trigger are not described in the available sources, and real-world impact depends on a reachable POP gadget chain that the evidence does not confirm; no public exploit was identified at time of analysis. Patchstack reported the flaw, and no fixed version is listed in the provided evidence.