Nuts
Monthly
Unauthenticated PHP object injection in the ThemeREX 'Nuts' WordPress theme (versions up to and including 1.12) lets remote attackers pass crafted serialized data into a PHP unserialize() path without any credentials, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) by the reporter. Actual exploitation success is conditional: the practical impact depends on a usable POP/gadget chain being present in the theme or in co-installed plugins or WordPress core, and the available sources do not confirm such a chain or identify the exact request/feature that reaches the deserialization sink. No public exploit code is confirmed and the CVE is not in CISA KEV, although the vuln.today decision label is act_now, so this should be treated as a high-priority patch item for sites running the theme rather than as an actively exploited emergency.
Unauthenticated PHP object injection in the ThemeREX 'Nuts' WordPress theme (versions up to and including 1.12) lets remote attackers pass crafted serialized data into a PHP unserialize() path without any credentials, rated CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) by the reporter. Actual exploitation success is conditional: the practical impact depends on a usable POP/gadget chain being present in the theme or in co-installed plugins or WordPress core, and the available sources do not confirm such a chain or identify the exact request/feature that reaches the deserialization sink. No public exploit code is confirmed and the CVE is not in CISA KEV, although the vuln.today decision label is act_now, so this should be treated as a high-priority patch item for sites running the theme rather than as an actively exploited emergency.