Muzicon
Monthly
Unauthenticated PHP object injection in the ThemeRex Muzicon WordPress theme through version 1.15 allows remote attackers to pass attacker-controlled serialized data into an unserialize() sink without any credentials, which can corrupt application state or escalate to code execution if a usable gadget chain is reachable. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is tracked under CWE-502; no public exploit code has been reported, it is not listed in CISA KEV, and no EPSS figure was supplied. The practical limiting factor is the need for a POP chain in the theme, WordPress core, or a co-installed plugin, and the precise vulnerable endpoint and parameter are not described in the available sources.
Unauthenticated PHP object injection in the ThemeRex Muzicon WordPress theme through version 1.15 allows remote attackers to pass attacker-controlled serialized data into an unserialize() sink without any credentials, which can corrupt application state or escalate to code execution if a usable gadget chain is reachable. The vulnerability carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is tracked under CWE-502; no public exploit code has been reported, it is not listed in CISA KEV, and no EPSS figure was supplied. The practical limiting factor is the need for a POP chain in the theme, WordPress core, or a co-installed plugin, and the precise vulnerable endpoint and parameter are not described in the available sources.