Photolia
Monthly
PHP object injection in the Photolia WordPress theme (versions <= 1.0.3) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to code execution, file manipulation, or data theft if a usable POP gadget chain exists in the WordPress environment. Although rated CVSS 9.8, the practical risk is tempered by the requirement for a reachable gadget chain in core or co-installed components, and no public exploit has been identified at time of analysis. Site owners should treat this as high severity but prioritize based on exposure.
PHP object injection in the Photolia WordPress theme (versions <= 1.0.3) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to code execution, file manipulation, or data theft if a usable POP gadget chain exists in the WordPress environment. Although rated CVSS 9.8, the practical risk is tempered by the requirement for a reachable gadget chain in core or co-installed components, and no public exploit has been identified at time of analysis. Site owners should treat this as high severity but prioritize based on exposure.