Motorix
Monthly
PHP object injection in the commercial WordPress theme Motorix (ThemeRex) at version 1.11 and earlier lets unauthenticated remote attackers pass serialized input that reaches a PHP unserialize() call, potentially instantiating arbitrary objects and - if a usable POP gadget chain is present in the theme, its bundled plugins or WordPress core - escalating to code execution or full site compromise. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates confidentiality, integrity and availability impact as high, and the vuln.today decision label is act_now, so it should be handled as a near-term patching priority rather than a high-score-but-low-risk item. No CISA KEV entry and no public exploit code were identified in the available sources at time of analysis, and the input parameter and gadget chain involved are not described.
PHP object injection in the commercial WordPress theme Motorix (ThemeRex) at version 1.11 and earlier lets unauthenticated remote attackers pass serialized input that reaches a PHP unserialize() call, potentially instantiating arbitrary objects and - if a usable POP gadget chain is present in the theme, its bundled plugins or WordPress core - escalating to code execution or full site compromise. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates confidentiality, integrity and availability impact as high, and the vuln.today decision label is act_now, so it should be handled as a near-term patching priority rather than a high-score-but-low-risk item. No CISA KEV entry and no public exploit code were identified in the available sources at time of analysis, and the input parameter and gadget chain involved are not described.