Mission
Monthly
Unauthenticated PHP object injection in the ThemeREX Mission theme for WordPress, versions up to and including 1.22, lets remote attackers feed attacker-controlled serialized data into a PHP deserialization sink, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with maximal confidentiality, integrity and availability impact. Only sites running this specific theme at 1.22 or earlier are exposed, which limits the attackable population, but no login or user interaction is required to reach the flaw. The issue was reported through Patchstack and is rated act_now by vulnerability intelligence; the supplied data contains no CISA KEV entry and no confirmed working exploit code, so no public exploit is identified at time of analysis, and the supplier did not identify the specific injectable parameter or a usable gadget chain, meaning realized impact may vary site by site.
Unauthenticated Local File Inclusion affects the ThemeREX Mission WordPress theme in all versions up to and including 1.22, enabling remote attackers to coerce the PHP application into including arbitrary local files. Exploitation can lead to sensitive file disclosure, source-code exposure, and - depending on what files are accessible on the server - remote code execution via log poisoning or PHP wrapper abuse. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated PHP object injection in the ThemeREX Mission theme for WordPress, versions up to and including 1.22, lets remote attackers feed attacker-controlled serialized data into a PHP deserialization sink, carrying a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) with maximal confidentiality, integrity and availability impact. Only sites running this specific theme at 1.22 or earlier are exposed, which limits the attackable population, but no login or user interaction is required to reach the flaw. The issue was reported through Patchstack and is rated act_now by vulnerability intelligence; the supplied data contains no CISA KEV entry and no confirmed working exploit code, so no public exploit is identified at time of analysis, and the supplier did not identify the specific injectable parameter or a usable gadget chain, meaning realized impact may vary site by site.
Unauthenticated Local File Inclusion affects the ThemeREX Mission WordPress theme in all versions up to and including 1.22, enabling remote attackers to coerce the PHP application into including arbitrary local files. Exploitation can lead to sensitive file disclosure, source-code exposure, and - depending on what files are accessible on the server - remote code execution via log poisoning or PHP wrapper abuse. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.