Orpheus
Monthly
Unauthenticated PHP object injection in the ThemeRex Orpheus WordPress theme, affecting versions 1.8 and earlier, lets remote attackers reach unsafe deserialization of attacker-supplied data, carrying an assessed CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) against confidentiality, integrity and availability. The exact injection point, endpoint or feature that reaches the unsafe unserialize call is not described in the available sources, and real-world impact depends on a usable PHP gadget (POP) chain existing in the theme, WordPress core, or co-installed plugins, which the sources do not confirm. No public exploit code or CISA KEV entry was identified at time of analysis, but the issue is prioritized act_now in vuln.today's decision signals and was reported through Patchstack.
Unauthenticated Local File Inclusion in the ThemeREX Orpheus WordPress theme (versions <= 1.3) allows remote attackers to read arbitrary files on the server and potentially achieve code execution via PHP file inclusion. The flaw stems from improper control of filenames in an include/require statement (CWE-98), and while no public exploit has been identified at time of analysis, the CVSS 8.1 rating reflects high impact across confidentiality, integrity, and availability. Risk is somewhat tempered by the high attack complexity metric in the CVSS vector.
Unauthenticated PHP object injection in the ThemeRex Orpheus WordPress theme, affecting versions 1.8 and earlier, lets remote attackers reach unsafe deserialization of attacker-supplied data, carrying an assessed CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) against confidentiality, integrity and availability. The exact injection point, endpoint or feature that reaches the unsafe unserialize call is not described in the available sources, and real-world impact depends on a usable PHP gadget (POP) chain existing in the theme, WordPress core, or co-installed plugins, which the sources do not confirm. No public exploit code or CISA KEV entry was identified at time of analysis, but the issue is prioritized act_now in vuln.today's decision signals and was reported through Patchstack.
Unauthenticated Local File Inclusion in the ThemeREX Orpheus WordPress theme (versions <= 1.3) allows remote attackers to read arbitrary files on the server and potentially achieve code execution via PHP file inclusion. The flaw stems from improper control of filenames in an include/require statement (CWE-98), and while no public exploit has been identified at time of analysis, the CVSS 8.1 rating reflects high impact across confidentiality, integrity, and availability. Risk is somewhat tempered by the high attack complexity metric in the CVSS vector.