PHP
Monthly
Unauthenticated PHP object injection in the FC United WordPress theme (Axiom Themes, versions up to and including 1.1.1) allows remote attackers to pass crafted serialized input that the theme unserializes without validation, potentially leading to code execution, file manipulation, or database compromise depending on the gadget chains available on the host site. The 9.8 CVSS score reflects a fully remote, unauthenticated attack path with no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but there is no public exploit identified at time of analysis and no CISA KEV listing; all severity signals are theoretical rather than empirical. Real-world impact is further bounded by CWE-502's dependency on a reachable POP gadget chain in the theme, WordPress core, or an installed plugin, and by the theme's limited deployment footprint.
Unauthenticated PHP object injection in the ThemeREX ShiftCV WordPress theme, affecting versions up to and including 3.0.14, lets remote attackers feed crafted serialized input into an unsafe deserialization sink, which can escalate to remote code execution when a usable POP gadget chain is reachable in the theme, WordPress core, or an installed plugin. The flaw carries a 9.8 Critical rating (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication and no user interaction are required and successful exploitation can fully compromise confidentiality, integrity and availability. There is no public exploit identified at time of analysis and no CISA KEV confirmation, so the practical limiting factor is the availability of a reachable gadget chain rather than the injection primitive itself; no EPSS score was supplied in the available intelligence.
Unauthenticated PHP object injection in the WordPress theme Windsor (ThemeREX) through version 2.10 lets remote attackers feed crafted serialized data into an unserialize() call reachable without authentication or user interaction, scoring a maximum base 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Reported by Patchstack and tracked as CWE-502, the flaw's realized impact depends on whether a usable PHP gadget chain exists across the theme, WordPress core, and installed plugins - in an unpatched site with a suitable gadget, this can escalate to code execution, arbitrary file or data manipulation, whereas without one the injection may be largely inert. At time of analysis there is no public exploit code identified and no CISA KEV listing, so exploitation is not confirmed in the wild; no vendor-released fix version appears in the available advisory data. Given the unauthenticated, network-reachable profile and the prevalence of gadget-rich plugin stacks, this should be treated as high priority for any site running the theme.
Unauthenticated PHP object injection in the ThemeRex Education Center WordPress theme (versions up to and including 3.6.12) lets remote attackers feed serialized data into an unserialize() sink with no authentication and no user interaction, scored CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Actual damage depends on whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins, because that determines whether object injection escalates to code execution or full confidentiality, integrity, and availability loss. No public exploit code and no CISA KEV listing were identified at time of analysis, and real-world exposure is constrained by the narrow installed base of this specific commercial theme.
Unauthenticated PHP object injection in the Ancorathemes Drone Media WordPress theme, affecting all versions through 2.2.0, lets a remote attacker supply a crafted serialized PHP object to a theme-reachable sink without authentication, no user interaction, and low attack complexity, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N base vector scored 9.8. Because successful exploitation depends on a usable property-oriented programming (POP) gadget chain being present in the theme, WordPress core, or an installed plugin, the maximum C:H/I:H/A:H impact - typically code execution, file manipulation, or full site takeover - is only realized when such a chain exists; otherwise the realized impact may be lower. At time of analysis there was no public exploit code identified and no evidence of confirmed active exploitation (not listed in CISA KEV), though the combination of an unauthenticated, network-reachable, low-complexity injection sink makes this a high-priority target for attackers once a chain is publicized. Reported by Patchstack against the CPE cpe:2.3:a:ancorathemes:drone_media.
PHP object injection in WooCommerce Multilingual & Multicurrency 5.5.8 and earlier allows an authenticated user with the shop manager role (or higher) to submit crafted serialized input to a plugin endpoint, potentially leading to high confidentiality, integrity, and availability impact if a usable POP gadget chain is present in the loaded code. The vulnerability carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction beyond the attacker's own authenticated request, but it is not accessible to anonymous visitors or ordinary customers. No public exploit identified at time of analysis.
Unauthenticated PHP object injection in the ThemeRex 'Asia Garden' WordPress theme (versions 1.3.1 and earlier) allows remote attackers to pass crafted serialized data into PHP's unserialize() and instantiate arbitrary objects on the target site. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical), exploitation requires no authentication or user interaction against an affected installation and could yield full confidentiality, integrity, and availability impact - typically arbitrary code execution, file manipulation, or SQL injection when a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (CISA KEV); no EPSS score was supplied. Practical exploitability hinges on the presence of a viable gadget chain, without which impact may drop to denial of service or be difficult to weaponize, and the exact vulnerable parameter/endpoint is not detailed in the available data.
Unauthenticated PHP object injection in the WordPress theme N7 | Golf Club Sports & Events (versions 2.21 and earlier, vendor ThemeREX) lets a remote attacker supply a crafted serialized PHP object to a theme endpoint without any authentication or user interaction, yielding a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Because no public exploit code and no CISA KEV entry were identified at time of analysis, real-world impact hinges on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin; where such a chain is reachable, the deserialization flaw can escalate to full remote code execution. Exposure is limited to sites that have this specific niche golf/sports theme installed and active, but for those sites the worst-case profile is complete compromise by an unauthenticated attacker.
Unauthenticated PHP object injection in the ThemeRex Invetex WordPress theme affects versions 2.18 and earlier, allowing remote attackers to supply crafted serialized input to a theme endpoint that performs unsafe deserialization. Successful exploitation can lead to full compromise of the confidentiality, integrity, and availability of the affected site, but the practical ceiling depends on whether a usable PHP POP gadget chain exists in the theme, an active plugin, or WordPress core. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS score should be weighed against the assessed AC:H rather than the reported AC:L.
Unauthenticated PHP object injection in the ThemeRex 'Law Office' WordPress theme at version 3.20 and earlier lets remote attackers with no credentials and no user interaction pass attacker-controlled serialized data into an unsafe unserialize() path, which the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) scores as complete loss of confidentiality, integrity and availability. Practical impact depends heavily on whether a usable POP gadget chain exists in the theme, an installed plugin, or WordPress core; without a reachable gadget the result may be far below the theoretical 9.8 headline score. No CISA KEV entry, EPSS score, or public exploit code is present in the available intelligence, so this is assessed as no public exploit identified at time of analysis, and exposure is limited to sites running this commercial legal-industry theme.
Unauthenticated local file inclusion in the KuteShop WordPress theme through version 4.2.9 allows remote attackers to read files from the hosting server - and, given the CWE-98 root cause, potentially to influence which PHP file is included - without any login or victim interaction. The issue is rated CVSS 3.1 8.1 (High) with a network vector (AV:N), no privileges (PR:N) and no user interaction (UI:N), but high attack complexity (AC:H), which indicates exploitation depends on a specific request format, parameter, or theme configuration rather than a trivial default-configuration request. Impact is high across confidentiality, integrity, and availability; no public exploit identified at time of analysis, and reports come from Patchstack, so exposure is limited to sites running this commercial theme with an affected version installed and active.
Unauthenticated local file inclusion in the Boutique WordPress theme from KuteThemes (CPE cpe:2.3:a:kutethemes:boutique) through version 2.3.3 allows a remote attacker to influence a PHP include/require path and read arbitrary local files from the web server without any login or victim interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1, CWE-98). The high attack complexity signals that exploitation is not a simple one-shot request: the attacker must craft a path that survives the theme's filtering and the target's PHP configuration (notably wrapper and allow_url_include settings) before confidentiality, integrity and availability impact materializes at the rated level. There is no public exploit code identified at time of analysis and no CISA KEV listing; the impact beyond local file disclosure - including any escalation to code execution implied by the I:H/A:H sub-scores - is conditional and not confirmed by the description. The only advisory data available is the Patchstack disclosure for the KuteThemes Boutique theme.
Unauthenticated local file inclusion in the KuteThemes Biolife WordPress theme through version 3.2.3 allows remote attackers to steer a PHP include/require path and read arbitrary files from the hosting server, exposing wp-config.php database credentials, API keys, and other sensitive content. The reported vector scores 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but independent assessment narrows realistic impact to confidentiality loss (C:H/I:N/A:N): the attack is unauthenticated and remote, yet high-complexity because the exact vulnerable parameter, encoding, and configuration prerequisites are not documented, so a single guaranteed payload is not established. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exposure is limited to the niche set of sites running this commercial theme at or below 3.2.3.
Unauthenticated local file inclusion in the TechOne WordPress theme (versions 3.0.3 and earlier) allows remote attackers to read arbitrary files from the server by supplying crafted input to a vulnerable PHP include/require statement. No public exploit code has been identified at time of analysis, and the vendor has not released a patched version. While the reported CVSS base score is 8.1, the independent assessment limits the impact to confidentiality (C:H) with high attack complexity (AC:H) and no confirmed escalation to code execution, so real-world priority is moderate despite the high score.
Local file inclusion in the Armania WordPress theme (versions up to and including 1.4.8) allows unauthenticated remote attackers to read arbitrary files on the underlying server, potentially exposing sensitive data such as wp-config.php. The vulnerability stems from improper handling of user-supplied input passed to a PHP include/require statement (CWE-98). No public exploit code or active exploitation has been reported at time of analysis; the vendor rates it 8.1 with high attack complexity, while our assessment confirms network reachability with no authentication or user interaction but notes a non-trivial precondition is required for reliable exploitation.
Unauthenticated PHP object injection in the ThemeRex WineShop WordPress theme (all versions up to and including 3.20) lets remote attackers push attacker-controlled serialized data into a PHP unserialize() operation, enabling instantiation of arbitrary PHP objects and - where a usable gadget chain exists in the theme, co-installed plugins, or the runtime - remote code execution, arbitrary file read/write, or SQL injection. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), meaning exploitation against a default installation requires no authentication and no user interaction, per the published PR:N/UI:N vector. At time of analysis there is no public exploit code identified and the theme is not listed in CISA KEV; practical exposure is limited to sites actually running this niche wine-shop theme and by whether an exploitable POP gadget chain is reachable.
Unauthenticated PHP object injection in the ThemeRex Equadio WordPress theme (versions up to and including 1.1.4) allows remote attackers to supply crafted serialized input to vulnerable deserialization entry points, potentially leading to remote code execution, file deletion, or other high-impact outcomes depending on available gadget chains. The flaw carries a CVSS 3.1 base score of 9.8, reflecting network exploitability with low complexity, no authentication, and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, though the severity and ease of exploitation make prompt patching critical.
Unauthenticated PHP Object Injection in the ThemeRex 'Juno' WordPress theme affects all versions up to and including 2.25, allowing remote attackers to supply a crafted serialized PHP object that the theme deserializes without validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates this as a network-reachable, low-complexity flaw requiring no credentials and no user interaction, with high confidentiality, integrity and availability impact; however, real-world impact depends on whether a usable POP gadget chain exists in the theme or in co-installed plugins, which is not confirmed in the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis (Patchstack is credited as the reporting source), and exploitation is limited to the subset of WordPress sites running this specific commercial theme at an affected version.
Unauthenticated PHP object injection in the BoldThemes Avala WordPress theme at version 1.1.4 and earlier lets remote attackers pass attacker-controlled data into PHP's unserialize() through a publicly reachable code path, with no authentication or user interaction required (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Real-world impact - remote code execution, arbitrary file read/write/delete, or SQL injection - depends on the presence of a usable POP/gadget chain in the theme itself, WordPress core, or another installed plugin; without such a chain the injection may be inert, so the 9.8 score represents a worst-case profile rather than a guaranteed outcome. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation requires the Avala theme to be installed and active at version 1.1.4 or below.
Unauthenticated PHP object injection in the Kalles WordPress theme (versions up to and including 1.1.7.1) allows a remote attacker to pass crafted serialized data into a PHP unserialize() call, which on a site that loads a usable gadget chain can escalate to full compromise of the WordPress installation - sensitive data theft, arbitrary content or code modification, and denial of service. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity flaw requiring no credentials and no user interaction, consistent with the CWE-502 classification, and no public exploit has been identified at time of analysis. Real-world impact is bounded by gadget availability in the surrounding WordPress core, plugins, and bundled libraries, so not every installation will reach the full high-confidentiality/integrity/availability outcome.
Unauthenticated local file inclusion in the WordPress Backhoe theme (versions 2.0 and earlier, vendor 'mymoun') lets remote attackers cause a server-side PHP include/require construct to load a file path they influence, exposing sensitive local files such as wp-config.php and disclosed configuration data. The supplied CVSS vector is AV:N/AC:H/PR:N/UI:N, and the independent assessment scores confidentiality only (C:H/I:N/A:N), so the practical impact is information disclosure rather than code execution or data modification, with the high attack-complexity component reflecting an unnamed precondition (the specific vulnerable parameter, endpoint, or environment configuration) that must be derived from the Patchstack advisory. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation is limited to sites actually running this low-popularity theme, and sites on a patched release or not using Backhoe are unaffected.
Unauthenticated local file inclusion in the Ozeum WordPress theme (ThemeREX) through version 1.3.0 allows remote attackers to control a PHP include/require path and read arbitrary files on the hosting server, potentially exposing wp-config.php database credentials, API keys, and other sensitive content. Patchstack reports this as a High-severity issue at CVSS 8.1, while the independent assessment keeps attack complexity High (AC:H) and lowers integrity and availability impact to Low (C:H/I:L/A:L), meaning reliable exploitation hinges on conditions the attacker does not fully control and the realistic exposure is confined to sites running this specific theme at or below 1.3.0. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated local file inclusion in the Flipmart WordPress theme (versions up to and including 2.8, published by ckthemes) allows remote attackers to force the theme's PHP code to include and disclose files on the underlying server. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N per this assessment) confirms no authentication (PR:N) and no user interaction (UI:N) are needed, but the high attack-complexity rating indicates exploitation depends on specific request parameters, path-traversal or stream-wrapper encoding, or particular PHP/server configuration rather than succeeding against every deployment. The primary demonstrated impact is confidentiality loss (arbitrary file read); escalation to code execution would require includable attacker-influenced content such as logs or uploads and is not established by the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patch has been identified; a Patchstack advisory documents the issue.
Unauthenticated local file inclusion in the CocoBasic Fabius WordPress theme (versions 1.0 and earlier) allows remote attackers to read arbitrary files on the server via crafted requests that reach an include/require statement. The assessed impact is limited to confidentiality (no integrity or availability impact), and the high attack complexity (AC:H) means successful exploitation depends on specific request crafting and server configuration, such as the presence of poisonable files or permissive PHP wrappers. No public exploit code has been identified and the theme's small deployment footprint further reduces risk, making this a moderate-priority issue.
Unauthenticated local file inclusion in the Teoro WordPress theme (CocoBasic) at versions 1.1 and below lets a remote attacker induce the theme's PHP code to include a locally present file - most critically wp-config.php - exposing database credentials and salts that can be reused to take over the site. The vulnerability requires no credentials (PR:N) and no user interaction (UI:N), but the CVSS AC:H metric indicates a meaningful precondition outside the attacker's direct control (for example a specific request/encoding state or environment configuration), and exposure is limited to sites actively running this specific theme at a vulnerable version; there is no CISA KEV listing and no public exploit identified at time of analysis. The published base score is 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while the assessed vector lowers integrity and availability impact to L, so real-world risk skews toward moderate rather than critical.
Unauthenticated local file inclusion in the CocoBasic Kaven WordPress theme (versions 1.2 and earlier) allows remote attackers to cause the theme to include and output files from the underlying server, exposing sensitive content such as wp-config.php, credential files, and other data outside the web root. The affected population is limited: Kaven is a niche commercial WordPress theme, so exposure is small compared with core WordPress or high-volume plugins, and no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV. Exploitation is not trivial despite the unauthenticated vector - the CVSS AC:H rating and our independent assessment indicate a required non-default precondition or non-deterministic element (for example a specific theme parameter or feature being reachable, knowledge of an absolute file path, or particular PHP configuration such as allow_url_include) that the public advisory does not fully detail.
Unauthenticated local file inclusion in the Volos WordPress theme (versions 1.2 and below, published by CocoBasic) allows remote attackers to influence a PHP include/require path and pull in arbitrary local files on any site running the affected theme. The vulnerability is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), but the high attack complexity score indicates a non-trivial precondition - a specific configuration, path, or environmental state - must be satisfied for reliable exploitation, and the affected installed base is limited to sites actively running Volos. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so exploitation is expected to be opportunistic rather than mass-campaign driven.
Unauthenticated local file inclusion in CocoBasic's Cardea WordPress theme (version 2.3 and earlier) lets remote attackers feed attacker-influenced input into a PHP include/require path, exposing arbitrary local files and - per the assessed vector's high integrity impact - potentially enabling code execution or file tampering if the right secondary conditions are met. The flaw needs neither authentication (PR:N) nor user interaction (UI:N), but the high attack complexity (AC:H) indicates a non-trivial precondition or configuration-dependent circumstance that the single Patchstack advisory does not spell out, so reliable exploitation against every default install is not guaranteed. Exploitation is bounded by the requirement that the Cardea theme be installed and active, there is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, making this a moderate-priority issue rather than an emergency.
Unauthenticated PHP object injection in the ThemeRex 'Yacht Rental' WordPress theme affects all versions up to and including 2.6, allowing a remote attacker to pass crafted serialized data into a PHP deserialization path without credentials or user interaction. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the theoretical worst case is high confidentiality, integrity, and availability impact with a 9.8 base score. No public exploit code has been identified at time of analysis, and the practical severity depends on whether a usable PHP gadget chain exists within the theme, WordPress core, or co-installed plugins - without such a gadget, real-world impact may be reduced.
Unauthenticated PHP Object Injection in the Wine House WordPress theme (version 3.20 and earlier, distributed by ThemeREX) allows a remote attacker to deliver a crafted serialized payload to an unserialize() call, which the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates at 9.8 Critical with full Confidentiality, Integrity, and Availability impact. Because PR:N and UI:N are confirmed by the vector, no authentication or victim interaction is required - any unauthenticated request to the affected endpoint against a site with the theme installed and active can carry the payload. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical severity is bounded by whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins; absent such a gadget, impact may degrade to denial of service or be non-exploitable, and the target population is limited to sites running this single commercial theme.
Unauthenticated PHP object injection in the ThemeREX Tipsy WordPress theme through version 1.6 allows remote attackers to supply crafted serialized data that the theme passes to PHP unserialize(), potentially leading to remote code execution, file manipulation, or SQL injection where a usable POP gadget chain exists. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the flaw is network-reachable, low-complexity, and requires neither authentication nor user interaction, with full confidentiality, integrity, and availability impact (9.8). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation is constrained by the need for an exploitable gadget chain in the theme, WordPress core, or an active plugin.
Unauthenticated PHP object injection in the Stargaze WordPress theme (versions 1.10 and earlier) allows remote attackers to submit a crafted serialized payload that the theme feeds to PHP's unserialize(), which can trigger arbitrary object instantiation and, where a usable gadget chain is present, code execution or full site compromise; the maximum-base CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact. Per that vector no authentication (PR:N) and no user interaction (UI:N) are required, and the CPE record cpe:2.3:a:themerex:stargaze ties the exposure to the ThemeREX Stargaze theme, so only sites with this theme installed and active are in scope. At time of analysis there is no public exploit identified, and the practical ceiling on impact depends on whether a viable POP gadget chain exists in the theme itself, a co-installed plugin, or WordPress core.
Unauthenticated PHP object injection in the ThemeRex Splendour WordPress theme (versions 1.23 and earlier) lets remote attackers pass crafted serialized data into an unsafe deserialization routine, which can lead to remote code execution, arbitrary file manipulation, or full site takeover if a usable gadget chain is reachable. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-502 Deserialization of Untrusted Data; the vector confirms the entry point is reachable over the network with no authentication and no user interaction. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited, so real-world impact hinges on the presence of a POP gadget chain in the theme, co-installed plugins, or WordPress core, and on the narrow deployment footprint of this specific commercial theme.
Unauthenticated local file inclusion in the DirectoryPress WordPress plugin (versions up to and including 3.6.27) allows any remote attacker to read arbitrary files on the hosting server, exposing items such as wp-config.php with database credentials and authentication salts. The reporter's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) reflects a fully remote, unauthenticated, low-complexity attack requiring no user interaction, and the plugin's modest deployment footprint is the main practical limit on exploitation rather than any configuration prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis; independent review narrows realistic impact to confidentiality loss (C:H/I:N/A:N), with escalation to code execution dependent on unconfirmed server conditions such as writable log or session files and PHP wrapper availability.
PHP object injection in the Angio WordPress theme (versions 1.1.1 and earlier) allows authenticated attackers with Subscriber-level access to supply malicious serialized data, potentially achieving remote code execution, file manipulation, or other high-impact outcomes if a usable gadget chain exists in the theme, plugins, or WordPress core. Exploitation requires an authenticated Subscriber account (CVSS vector PR:L), which is often obtainable through open user registration, and no public exploit code or active exploitation has been identified at time of analysis. This is a priority-worthy flaw but not an emergency, as practical impact is contingent on the presence of a gadget chain.
Unauthenticated local file inclusion in the Mikado Themes 'TouchUp' WordPress theme (all versions below 1.4) lets remote attackers reach a PHP file-inclusion routine without any credentials or user interaction, exposing arbitrary files on the web server. Our assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality-only impact with high attack complexity, meaning successful exploitation depends on specific request conditions, path constraints or server configuration and is not guaranteed against every default install. Impact is confined to self-hosted WordPress sites running this specific theme, and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor-released fix is TouchUp 1.4.
Local file inclusion in KuteThemes DukaMarket WordPress theme through version 1.3.0 allows a remote unauthenticated attacker to read arbitrary local files on an affected web server, though the independent assessment limits impact to confidentiality only (C:H/I:N/A:N) rather than integrity or availability. Successful exploitation is constrained by high attack complexity (AC:H), typically requiring a specific traversal or filter-bypass condition, and real-world exposure is limited to WordPress sites running this theme. No CISA KEV entry is present, no public exploit identified at time of analysis, and no EPSS score is supplied; the submitted CVSS 8.1 appears to reflect high integrity/availability impact that the independent assessment does not confirm.
Unauthenticated local file inclusion in the Uminex WordPress theme from Kutethemes affects every release up to and including 1.0.9, allowing a remote attacker who can reach an affected installation to supply crafted input to a PHP file-inclusion code path and read files from the underlying server. Patchstack published the issue at CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), whereas our independent assessment narrows the realistic outcome to disclosure of local files only (C:H/I:N/A:N) with a lower attack complexity, so integrity and availability impact should not be assumed without a demonstrated exploit. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the intelligence; the signals are mixed and point to moderate rather than emergency priority.
Unauthenticated local file inclusion in the Aalto WordPress theme (vendor Edge Themes) at versions 1.8 and earlier allows remote attackers to steer the theme's PHP include/require logic toward attacker-influenced file paths, producing the high confidentiality, integrity, and availability impact reflected in the assessed CVSS of 8.1. The vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, so no authentication or user interaction is required but a non-default precondition - such as a specific request parameter, a reachable theme code path, or includable content the attacker can reference - must be satisfied for exploitation to succeed, which is why the issue is context-dependent rather than universally exploitable. Exposure is limited to sites actively running the Aalto theme at 1.8 or below; there is no public exploit identified at time of analysis and the theme is not confirmed actively exploited (no CISA KEV listing).
Unauthenticated local file inclusion (LFI) in the CleanSkin WordPress theme versions 1.5.0 and earlier allows remote attackers to include and potentially execute arbitrary local files, leading to information disclosure or, under specific conditions, code execution. The CVSS score is 8.1 (High), but exploitation requires high attack complexity (AC:H) and the exact vulnerable parameter or endpoint is not disclosed, so the practical risk is tempered. No public exploit code exists at time of analysis, and the Patchstack advisory does not specify a fixed version.
Unauthenticated PHP object injection in the Ancora Themes CleanSkin WordPress theme (versions up to and including 1.5.0) allows remote attackers to pass attacker-controlled serialized data into an endpoint that deserializes it, as reflected by a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vector confirms the attack is network-reachable, low-complexity, and requires neither authentication nor user interaction against reachable installations, though real-world impact hinges on the presence of a usable POP gadget chain in the theme, WordPress core, or co-installed plugins - without one, the outcome may be limited to the injection itself. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing was provided); the available data contains no documented fixed version.
PHP object injection in the Dynamic User Directory WordPress plugin (versions 2.4 and earlier) allows an attacker holding a low-privileged account to feed attacker-controlled serialized data into an unserialize() call, potentially enabling arbitrary file operations, data disclosure, or remote code execution if a usable POP gadget chain exists within the plugin, WordPress core, or a co-installed plugin. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N), but our independent assessment lowers the privileges-required metric to Low (PR:L) because the Patchstack 'Subscriber' designation means the attacker must already hold a subscriber-level WordPress account; sites that disable open user registration substantially limit exposure. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated PHP object injection in Booster for WooCommerce (WordPress plugin slug woocommerce-jetpack, vendor pluggabl) at version 8.4.0 and earlier allows remote attackers to feed attacker-controlled serialized data into the plugin's deserialization path on any internet-facing WordPress/WooCommerce site, with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical) indicating no credentials, no user interaction, and no non-default configuration are required. Escalation to full remote code execution depends on whether a usable PHP POP gadget chain is reachable in the plugin or other loaded code at the point of unserialization, so the practical worst case is complete site compromise while the minimum case is a deserialization primitive with uncertain downstream effect. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; Patchstack is credited as the reporter.
Unauthenticated PHP object injection in Payever WooCommerce Gateway versions up to 4.8.2 allows remote attackers to pass serialized input to an unsafe PHP deserialization path, with a CVSS 3.1 base score of 9.8 reflecting potential full confidentiality, integrity, and availability impact on affected WordPress/WooCommerce sites. The issue is CWE-502 and is network-reachable with low complexity and no privileges or user interaction; no public exploit identified at time of analysis. Practical exploitation may depend on the presence of a usable POP gadget chain, so the real-world outcome can range from limited object injection to full code execution or other high-impact actions.
Local file inclusion in the Kids Care WordPress theme through version 3.2.4 allows unauthenticated remote attackers to manipulate a file-inclusion parameter and read local server files, with wp-config.php and other readable files as the primary exposure. The base CVSS vector is 8.1 with High Attack Complexity, but the independent assessment keeps the same unauthenticated and no-user-interaction prerequisites while bounding realistic impact to confidentiality-heavy local file disclosure with Low integrity and availability impact unless log poisoning or PHP wrappers enable escalation. No CISA KEV activity is identified in the provided data, and no public exploit identified at time of analysis; the independent assessment rates this as a credible but not top-tier priority.
Command execution in Spotweb through 1.5.8 can be triggered through the optional runcommand NZB handler when malicious Usenet spots carry shell metacharacters in their titles; a Spotweb user then has to download the spot so the unescaped title is substituted into $SPOTTITLE and passed to exec(). Exploitation does not require Spotweb authentication, but it is conditional on the runcommand handler being enabled and on passive victim interaction, and code runs with the privileges of the Spotweb PHP process. Publicly available exploit code exists, though no CISA KEV active exploitation is reported; instances without the runcommand integration are not exposed through this path.
Information disclosure in Open Source Social Network (OSSN) through 10.1 allows authenticated users to read other users' private message attachments by requesting the /messages/attachment/{guid} route with sequential or guessed file GUIDs. The flaw is an insecure direct object reference (CWE-639) in the default attachment handler, which outputs a file whenever it is typed as a message attachment without verifying that the requesting user is the sender or recipient; no user interaction is required, but a valid low-privileged account and a valid attachment GUID are needed. Publicly available exploit code exists (a HackMD writeup), and a vendor-linked fix commit is referenced, though a released patched version is not independently confirmed, and there is no indication of confirmed active exploitation (CISA KEV).
Unauthenticated remote attackers can delete arbitrary files on WordPress/WooCommerce sites running the PPOM - Product Addons & Custom Fields for WooCommerce plugin through version 34.0.10, abusing insufficient path validation in the rename_files function that is reachable via the plugin's cart/order file-handling path. Removing critical files such as wp-config.php can push the site into a re-installation state that is readily leveraged for remote code execution, and because the relocated file is moved byte-identically into the web-accessible wp-content/uploads/ppom_files/confirmed/ directory, the same flaw also exposes arbitrary file read for anything the web server user can read. Wordfence rates it 9.1 and independent assessment confirms CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. no authentication, privileges, or user interaction required against default internet-exposed configurations; no public exploit code has been identified at time of analysis. This is a genuine high-priority issue, not a CVSS-inflated one, with the main precondition being simply that the vulnerable plugin version is installed, active, and serving requests.
PHP Object Injection in the Bookly (Online Scheduling and Appointment Booking System) WordPress plugin, affecting all versions up to and including 28.2, lets authenticated users with Bookly 'custom-level' access or above pass a serialized payload through the plugin's 'value' parameter, which is then deserialized without validation; a successful chain could yield high confidentiality, integrity and availability impact. The decisive limiting factor is that no known gadget chain is available, so exploitation depends on a compatible gadget existing in another installed plugin, theme, or WordPress core, meaning default installations without such a gadget face injection without a direct exploit path. The flaw is not reachable by anonymous visitors (authentication required), and no public exploit code or CISA KEV entry has been identified at time of analysis.
Stored cross-site scripting in the Post Grid Gutenberg Blocks - PostX WordPress plugin, affecting all versions up to and including 5.1.0, allows an attacker holding a Subscriber-level account to plant JavaScript in the user display_name field that executes for any visitor viewing a page where the plugin renders its Archive Title block. The bypass works because WordPress core's pre_user_display_name filter uses ENT_NOQUOTES, encoding ampersands, angle brackets and greater-than signs but leaving double-quotes intact, so a crafted display_name breaks out of the alt="" attribute at Archive_Title.php:144. Reported by Wordfence with a CVSS v3.1 base score of 7.2; no public exploit identified at time of analysis, though the published CVSS vector claims PR:N while our assessment holds PR:L, since the attack requires an authenticated Subscriber-or-higher account created through open registration or an attacker-controlled low-privilege user.
Authenticated remote code execution in Rank Math SEO before 1.0.280 is possible because the WordPress plugin's settings import feature fails to validate uploaded file types, allowing an administrator to upload a PHP file for server-side execution. The CVSS vector is network-reachable but requires high privileges (PR:H), so an attacker must already hold administrator-level WordPress access; no public exploit was identified at time of analysis, and the vendor has released a patch. While the 7.2 base score looks significant, the administrator prerequisite makes this a comparatively low-real-risk issue for most deployments.
PHP Object Injection in LifterLMS through 10.2.1 requires an authenticated user with the edit_course capability-such as Instructor, Instructor's Assistant, LMS Manager, or Administrator-and is reachable only during lesson creation when a temporary lesson ID enters the custom metadata path in class.llms.admin.builder.php. Although rated high at CVSS 8.8, the plugin contains no POP gadget chain, so exploitation has no impact unless a separate installed plugin or theme provides a usable POP chain; if such a chain exists, an attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on the chain. No public exploit code or confirmed active exploitation was identified at time of analysis.
Local file inclusion in the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress (all versions up to and including 2.8.187) allows unauthenticated remote attackers to pass a crafted 'design_type' parameter through the plugin's tags-widget AJAX path and force the server to include attacker-chosen .php files, which the plugin's own geodir_basic_nonce does not meaningfully impede because that nonce is localized into the geodir_params script object on every public frontend page. The immediately attainable impact is access-control bypass and disclosure of sensitive server-side data, while full arbitrary PHP code execution is conditional on an attacker-controllable .php file already existing on the server or being uploadable to it; the independent assessment rates the vector as AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, and no public exploit identified at time of analysis. Versions 2.8.188 and later are not affected because design_type is restricted to a fixed allowlist and template names are validated against directory traversal and null bytes.
Code injection in the Fastcache by Host.it WordPress plugin (all versions up to and including 1.7.4) allows an authenticated administrator-level user to write arbitrary Apache directives into the site's .htaccess file, which can be escalated to full remote code execution by setting php_value auto_prepend_file to load attacker-controlled PHP on every request. Exploitation requires the PR:H vector from the assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H score (7.2), i.e. a logged-in account with administrator privileges, and is further conditioned on the site running Apache with an .htaccess file the plugin can write and an AllowOverride configuration that honors php_value directives - on nginx or Apache with AllowOverride None the injected directives have no effect. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV; this is a genuine but access-gated privilege-to-RCE escalation rather than a mass-exploitable perimeter bug.
Unauthenticated remote code execution affects Expivi 3D Product Configurator for WooCommerce through version 2.16.2. Missing authentication and nonce checks on the wp_loaded handler, combined with unsanitized xpv_image POST input echoed into a Dompdf-rendered .phtml template with PHP execution enabled, lets any remote attacker execute code on the server. No public exploit identified at time of analysis; CVSS 9.8 and CWE-434 indicate critical, unauthenticated risk.
Unauthenticated arbitrary file upload in the WordPress plugin Extensions For CF7 (Contact Form 7 Database, Conditional Fields and Redirection) versions up to and including 3.4.5 allows remote attackers to write attacker-controlled files into the site's upload directory through the plugin's signature field, with remote code execution as the likely outcome. The flaw is reachable via the extcf7_submit function without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) but only on sites that have a Contact Form 7 form actually using the plugin's signature field; sites not exposing that field are not reachable through this vector. At time of analysis no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), and the vendor has released a fix in version 3.4.6, so the exposure window is bounded by how quickly affected sites update.
Stored cross-site scripting in the Contao CMS comments bundle lets an unauthenticated visitor submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php, so attacker-controlled script executes in the Contao backend origin when a backend user opens the Comments module. All Contao releases from 4.0.0 up to (but not including) 5.3.50 and 5.7.12 are affected, and successful exploitation requires a privileged backend user to view the Comments module (CVSS 9.3, AV:N/AC:L/PR:N/UI:R/S:C); no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation. Critically, moderation is not a mitigating control because unpublished/pending comments remain visible to moderators, so an unapproved malicious comment still triggers in that user's session.
Remote code execution in ILIAS LMS versions before 9.24, 10.12, and 11.5 lets an authenticated author who holds question-pool (QTI) import rights upload a crafted question-import archive that writes a .htaccess file plus a PHP payload into the web-served image directory, resulting in code execution as the web server user. The defect is an unrestricted file upload (CWE-434) in the QTI image-handling security class ilQtiMatImageSecurity, reached through the standard question import path with no non-default configuration required. Exploitation requires a legitimate, permissioned authoring account rather than anonymous access, no public exploit code has been identified at time of analysis, and vendor-released fixes are available in 9.24, 10.12, and 11.5; instances that limit QTI import rights to vetted staff face materially lower realistic risk.
Account takeover in PHPNuxBill through 2025.3.20 allows unauthenticated remote attackers who know a valid customer username to brute-force the six-digit otp_code in the customer password-reset flow at system/controllers/forgot.php; because the pre-patch code has no attempt limit or lockout, an attacker can guess the OTP within its roughly 600-second validity window and then read the newly set password from the HTTP response. The vendor has published an upstream fix and advisory, but no public exploit identified at time of analysis, and the independent assessment rates this as a genuine high-priority issue requiring only a known username and default configuration.
Unauthenticated SQL injection in the PHPNuxBill radius.php FreeRADIUS REST endpoint allows remote attackers to read arbitrary data from the application database - including customer records and stored credentials - by injecting crafted username, macAddr, or nasid parameters into the accounting or authenticate actions, which are interpolated directly into whereRaw() queries. All versions through 2025.3.20 are affected per the vendor advisory and CPE data (cpe:2.3:a:hotspotbilling:phpnuxbill:*:*), and exploitation requires only network reachability of radius.php, with no authentication and no user interaction. The supplier-scored CVSS 4.0 vector (9.3) asserts high confidentiality, integrity, and availability impact, whereas our independent assessment scopes the realistic impact to confidentiality loss (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis, so the decisive risk factor is whether radius.php is exposed beyond the trusted RADIUS/NAS segment.
Path traversal in KodExplorer before 4.55 lets an authenticated low-privileged user bypass the archive-extraction sanitizer and write files anywhere on the server by uploading a ZIP archive containing crafted names such as '....//'. Because the overwritten files can include core JavaScript assets, the flaw chains into stored XSS that can lead to administrator account takeover and, ultimately, remote code execution through unrestricted PHP file upload. Exploitation requires a valid low-privileged account and use of the unzip functionality, so this is a credible, actionable priority rather than a drop-everything emergency; no public exploit code has been identified at time of analysis and no CISA KEV entry confirms active exploitation, while a vendor patch is available in release 4.55.
Stored cross-site scripting and potential remote code execution in HortusFox (hortusfox-web) through version 6.3 allow authenticated users to upload files with client-supplied extensions via the plant attachment feature, which are stored under the web-accessible public/attachments/ directory. Uploaded HTML or SVG files lead to stored XSS when a victim opens them, while uploaded PHP files can execute code on servers where .htaccess restrictions are unenforced, though this RCE path requires a non-default misconfiguration. No public exploit code has been identified at time of analysis, although a public technical write-up demonstrating the stored XSS is referenced. The CVSS 4.0 base score is 7.7 (High), and an independent CVSS 3.1 assessment rates it High with C:H/I:H/A:H.
Local file inclusion in the Fuelthemes The Voux WordPress theme through version 6.9.5 lets unauthenticated remote attackers induce the server to include attacker-influenced local files - with possible escalation to PHP code execution if parseable content can be placed or referenced on the host - by reaching an undisclosed include/require code path (CVSS 3.1: 8.1, AV:N/AC:H/PR:N/UI:N). The high attack-complexity value indicates exploitation is not trivial and depends on a condition the Patchstack advisory does not disclose (likely a specific request parameter feeding a theme include/require call, or a particular theme function or page being active). No public exploit code and no confirmed active exploitation were identified at time of analysis, so this should be treated as a genuine but second-tier priority for sites running The Voux 6.9.5 or earlier.
Local file inclusion in the Fuelthemes Werkstatt WordPress theme (all versions through 4.8.3) allows unauthenticated remote attackers to route unsanitized input into a PHP include/require statement, exposing server-side files such as wp-config.php and potentially escalating to code execution if an attacker-controlled file can be placed on the target. The issue is rated CVSS 8.1 (High) under CWE-98; no public exploit code and no confirmed active exploitation were identified at time of analysis. Attack complexity is High (AC:H) because meaningful impact depends on server configuration and on an attacker-controllable includable path, and sites not running Werkstatt or already updated past 4.8.3 are not affected.
Remote code execution in the AWP Classifieds WordPress plugin before 4.4.9 allows an authenticated user holding the plugin's management capability to import a crafted ZIP archive whose contents are extracted without file-type validation, planting arbitrary PHP into a publicly accessible, network-shared directory. Because the extraction target is web-reachable, the uploaded PHP can be requested and executed, yielding code execution under the web server account. Exploitation is gated by the required management capability (CVSS PR:L), and a vendor patch is available in 4.4.9; publicly available exploit code exists and EPSS is low at 0.19% (8th percentile), with no CISA KEV listing indicating confirmed active exploitation. CWE-434 (unrestricted upload of a file with a dangerous type) is the root cause class.
Deeply nested GraphQL documents can crash PHP worker processes running the webonyx/graphql-php library in versions 15.32.2 and earlier, because the recursive-descent parser has no recursion depth limit and the resulting stack exhaustion becomes an uncatchable SIGSEGV. The flaw is remotely reachable unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 8.2) and the failure occurs during parsing, before query validation, depth analysis or complexity controls ever execute, so worker processes on PHP-FPM, Swoole, RoadRunner, ReactPHP or CLI runtimes are killed with no exception, log entry or recovery path. The vendor has released a fix in 15.32.3 that enables a default recursion limit of 256; there is no KEV listing and no public exploit identified at time of analysis, though the upstream advisory documents a minimal crashing payload of roughly 74 KB, which is below common HTTP body-size limits.
Server-side request forgery (SSRF) in the Malcolm file-upload component allows authenticated low-privilege attackers to force the server to download arbitrary URLs via the unmodified upstream FilePond PHP fetch API route, then read back the fetched content through the transfer directory. The flaw, identified as CWE-918, affects Malcolm deployments using the file-upload feature and can expose internal network services or cloud metadata due to curl's FOLLOWLOCATION behavior. No public exploit identified at time of analysis; exploitation requires access to the upload endpoint (PR:L), and impact is limited to confidentiality readback plus minor availability (storage consumption).
Malcolm, CISA's open-source network traffic analysis platform, ships an nginx-based reverse proxy whose Lua RBAC authorization layer and nginx's request routing normalize crafted URL paths differently, letting an authenticated user at any privilege level slip past role-based restrictions and reach administrative or role-gated endpoints. Rated CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw yields high confidentiality and integrity impact against every RBAC-protected path - file upload, the PHP server, htadmin, and authentication management interfaces - while requiring only network reachability plus a valid low-privilege account (PR:L), with no user interaction. There is no public exploit identified at time of analysis and no confirmed CISA KEV listing, but the low credential bar and the sensitivity of the exposed interfaces make this a genuine priority rather than a CVSS-inflated paper risk.
Remote code execution in ILIAS LMS (before 9.24, 10.x before 10.12, and 11.x before 11.5) allows an authenticated user with test-question authoring rights to inject ImageMagick convert options through the filename of an uploaded image in an image-map question. Because escapeshellcmd() does not neutralise tab characters, an author can smuggle extra command arguments that instruct convert to drop a PHP file under the web root, which is then executable by any visitor and yields remote code execution on the server. Exploitation requires a tutor/instructor-level account with access to assImagemapQuestionGUI, no public exploit code has been identified at time of analysis, and a vendor patch is available.
Two-factor authentication bypass in pH7Builder (pH7 Social Dating CMS) before 18.5.0 lets attackers who already know a valid account password brute-force the 6-digit TOTP code submitted to VerificationCodeFormProcess.php without any attempt throttling, ultimately taking over member, affiliate, or administrator accounts. Exploitation is second-order: it requires prior credential compromise (PR:L) plus 2FA enabled on the target account, and success depends on racing the OTP rotation window (AT:P), but when those conditions hold nothing stops unlimited guesses. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has shipped a fix in version 18.5.0 that reuses the existing per-IP login-attempt lockout.
An authenticated low-privileged member of a pH7Builder (pH7 Social Dating CMS) site running a version before 18.5.1 can upgrade themselves to the most expensive paid membership tier without paying the corresponding price. The payment controller trusts client-supplied plan and amount parameters - specifically item_number, cart_order_id, and the PayPal 'custom' field - so an attacker can pay a token amount (or submit an uncompleted PayPal IPN notification) and still be granted the highest tier and all of its paid features. The flaw requires a valid member account (CVSS 4.0 PR:L) and an instance that actually sells paid tiers through an enabled gateway, notably PayPal; no public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a fix in 18.5.1.
Quadratic-time denial of service in league/commonmark 2.0.0 through 2.10.1 lets unauthenticated remote attackers exhaust PHP worker CPU by submitting a single large Markdown paragraph made of pipe-free lines that do not begin with a letter, which forces the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() to rescan the entire growing paragraph buffer on every line. Successfully exploited, this drives seconds to tens of seconds of single-core CPU per request that scales with the square of the input size, enough to saturate worker pools and deny service to other users. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code was identified at time of analysis, though the attack is trivially derived from the published advisory; impact is limited to availability with no confidentiality or integrity effect, and only applications that render untrusted Markdown with the Table extension enabled are affected.
Unauthenticated blind SQL injection in the NetBoard CRM demo platform lets remote attackers read and modify backend database contents by sending a crafted POST request to the password-recovery endpoint /module/auth/recovery.php, where the 'user-name' parameter is passed unsafely into a SQL query. The flaw carries a maximum-severity CVSS 4.0 base score of 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L), so no credentials, user interaction, or non-default configuration are needed; the practical limiting factor is whether an instance of this specific demo application is reachable from the internet, since it is a demonstration platform rather than a widely deployed production CRM. No public exploit code has been identified at time of analysis, and no CISA KEV entry or EPSS score was supplied, so active exploitation is not confirmed; exploitation is demonstrated through Boolean, error-based, time-based, and UNION query techniques.
Unauthenticated arbitrary file upload in the Bricksforge plugin for WordPress (all versions up to and including 3.1.8.9) lets a remote attacker plant a PHP payload in the upload directory and execute it, resulting in complete compromise of the affected WordPress site (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack chain abuses the plugin's public 'bricksforge_regenerate_nonce' AJAX endpoint to obtain a valid nonce without credentials, uploads a GIF/PHP polyglot through the temporary file-upload path where MIME checks are actually performed, then re-submits a form whose 'temporaryFileUploads' parameter points at the already-validated file while the attacker-controlled 'url' field forces a .php extension on the final write. No authentication, interaction, or non-default configuration is required beyond an installed and active vulnerable plugin on a server that executes PHP from the upload location; no public exploit code was identified at time of analysis.
Unauthenticated account takeover, including full administrator compromise, affects WordPress sites running the Frontend Dashboard plugin versions 3.0.0 up to but not including 3.0.5. Missing authorization and nonce checks on actions available to unauthenticated users allow an attacker to invoke an arbitrary PHP function or class method with attacker-controlled arguments, resulting in complete loss of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV); the vendor has released a patch in version 3.0.5.
PHP object injection in the WordPress plugin Uncanny Automator - AI + Automation for WordPress (all versions up to and including 7.6.1.1) lets an authenticated attacker with Subscriber-level access or above pass attacker-controlled data into an unserialize() sink via recipe trigger meta, and a POP chain present in Uncanny Automator itself escalates that into deletion of arbitrary files on the server. Exploitation is conditional rather than trivial: it additionally requires at least one supported third-party integration plugin (PeepSo, MailPoet, WPForms, and similar) to be co-installed and a recipe to be configured so that attacker-supplied input is stored as trigger meta - a combination of prerequisites that is why the assessed vector is AC:H and the plugin's real-world exposure is best characterized as a genuine but conditional risk rather than a mass-exploitation emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated SQL injection in the OrdaSoft Simple Membership extension for Joomla (versions before 7.4.0) allows any remote attacker to read and manipulate the site's backend database through crafted input to the checkLoginPass task. The site/simplemembership.php endpoint dispatches task=checkLoginPass with no authentication or access-control check and concatenates the login request parameter straight into a SQL query with no escaping or parameterization, which scores 9.3 under CVSS 4.0 with PR:N and no user interaction required. Exploitation needs only that the component be installed and enabled on a publicly reachable Joomla site - no credentials, user interaction, or non-default setting - and no public exploit identified at time of analysis.
Unauthenticated PHP object injection in the String Locator WordPress plugin (versions before 2.6.8) lets an attacker store a crafted serialized PHP object in a database row via the plugin's database editor, with no authentication required (PR:N per the assessed vector). The payload only fires when a site administrator subsequently opens and saves that row in the editor, which is the UI:R precondition, and it escalates to remote code execution, arbitrary file deletion, or sensitive data disclosure only if a suitable POP gadget chain exists in another installed plugin or component, which is why our independent assessment rates attack complexity as High (AC:H) despite the raw CVSS 8.8 vector using AC:L. Publicly available exploit code exists, but the two gating conditions (an admin save action plus a usable gadget chain) meaningfully reduce real-world exploitability, and no CISA KEV listing confirms active exploitation.
Authenticated users holding the WordPress Editor role on sites running the WP Coder plugin (versions 4.0 up to but not including 4.5.2) can save and execute arbitrary PHP code on the server, resulting in full site compromise. The flaw is a privilege-boundary failure: the plugin gates its PHP code-execution feature on a content capability that the Editor role holds by default rather than restricting it to administrators, so no plugin misconfiguration is needed. Exploitation requires an existing Editor-level (or higher) account - it is not remote-unauthenticated - but publicly available exploit code exists, and the vendor has released WP Coder 4.5.2 to fix it. No confirmed active exploitation (CISA KEV) has been reported, so risk is concentrated on sites that hand Editor access to semi-trusted contributors.
Stored cross-site scripting in Sachertortephp (MISP's CakePHP-derived framework) lets an authenticated user who can control an attachment filename inject CR/LF or a double quote into the Content-Disposition header generated by CakeResponse::download(). A CR/LF causes PHP to drop the entire Content-Disposition header so the response body renders inline with its own Content-Type on the application origin, while a double quote permits injection of additional Content-Disposition parameters; the payload is stored via attribute downloads, proposal downloads, or restSearch exports and executes when another authenticated user views the affected page. No public exploit code has been identified at time of analysis; an upstream fix is available via vendor commits.
Unauthenticated remote code execution in the SPIP Crayons plugin before 3.5.0 allows any remote attacker to take over a SPIP site by reaching crayons_store.php without the secu_ anti-forgery parameter, which causes the authorization dispatcher to select an unconditionally-true handler instead of the legitimate modification check. With authorization bypassed, the attacker can write an arbitrary .html skeleton file, read configuration files that expose the site secret, and forge a signed AJAX context that executes the planted skeleton as PHP under the web-server user. The assessed impact is high across confidentiality, integrity, and availability (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H; vendor-scored 9.3), exploitation requires only that the Crayons plugin be installed and enabled below 3.5.0, and no public exploit code was identified at time of analysis though the flaw is trivially reachable and unauthenticated.
HortusFox versions before 6.2 expose an authenticated remote code execution path through the theme import feature (ThemeModule::startImport): an uploaded ZIP archive is extracted into the public web root before file names, extensions, or content are validated, so an attacker with an administrator account can bundle a PHP payload and an .htaccess file that re-enables PHP execution and then execute arbitrary OS commands as the web-server user by requesting the dropped file under the themes directory. Exploitation is gated by administrator privileges (CVSS PR:H), so practical risk depends on obtaining or compromising an admin account; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). The vendor addressed the flaw in the 6.2 release, and the issue is tracked under CWE-434 (unrestricted upload of a file with a dangerous type).
Code injection in Microsoft Kiota 0.5.0 through pre-1.35.0 allows attacker-controlled text embedded in an OpenAPI description to break out of the generated Java or PHP documentation comment and execute in the consuming application or build environment once that generated source is compiled and loaded (Java) or loaded (PHP). The flaw is reachable unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) but requires user interaction: a developer or CI pipeline must generate client code from an untrusted or tampered spec and then build or load the output, making this a build-time/supply-chain path rather than an attack on already-deployed runtime services. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; CVSS 3.1 base score is 8.8, and the issue is fixed in 1.35.0.
PHP code injection in the Smarty templating engine allows remote code execution in applications running Smarty 4.x before 4.5.8 or 5.x before 5.8.5 that render templates through the extends:/multi-component inheritance path with caching enabled. When such a template is compiled, the top-level unifunc never restores its nocache_hash, so the value is null; combined with an empty regex alternative in the cache-split logic, attacker-controlled assigned data containing a forged /*%%SmartyNocache:%%*/ marker is copied verbatim (bypassing PHP-tag neutralization) into the regenerated PHP cache file and executed on the next include. Exploitation is unauthenticated per the vendor CVSS vector (PR:N) but is gated by strict preconditions - inheritance-path templates, active caching, unescaped attacker-controlled output, and a fresh PHP process that reloads the compiled file after the cache entry is evicted (TTL expiry or cache clear) while compiled files persist - making it conditional rather than reliably on-demand; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Insecure deserialization in the TrueLayer Magento 2 Plugin's Psr16CacheAdapter component allows an attacker who already has write access to the Magento cache backend (Redis or Memcached) to achieve arbitrary code execution via crafted PHP objects. The flaw arises from PHP's unserialize() being called without class restrictions, and exploitation requires both cache-write capability-obtainable through local filesystem access or an exposed cache service-and the presence of a usable gadget chain in the deployed Magento/Adobe Commerce environment. Although rated CVSS 7.5, real-world risk is materially lower because the attack preconditions are stringent; no public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited.
Authenticated remote code execution in Craft CMS 5.10.13.2 allows any low-privilege Control Panel user to run operating-system commands as the PHP/web-server process by injecting Twig through the app/render-components action. The attack requires only basic CP access; a non-admin Team user with no optional permissions was shown to override an EntryType uiLabelFormat and trigger an Entry render that evaluates attacker-controlled Twig via renderObjectTemplate(). No public exploit identified at time of analysis, but the impact is severe because the render path is unsandboxed and can reach PHP functions such as system().
Unauthenticated PHP object injection in the Haaken WordPress theme affects all versions up to and including 1.5, allowing remote attackers to supply crafted serialized data to an unserialize() sink without any prior authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1). The conditional nature of the risk is captured by the AC:H rating: full impact (remote code execution or data compromise) generally depends on a usable POP gadget chain being present in the theme, WordPress core, or another installed plugin, so exposure is limited to sites actually running this theme at an affected version. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and several vectors beyond the single Patchstack advisory reference (EUVD-2026-93080) remain unpublished.
Unauthenticated PHP Object Injection in the GDPR Framework By Data443 WordPress plugin through version 2.5.0 allows remote attackers to pass crafted serialized data to a PHP unserialize() path, potentially achieving full confidentiality, integrity, and availability impact if a usable gadget chain is reachable. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction; the only prerequisite is an active vulnerable plugin installation. No public exploit code or CISA KEV entry was identified at time of analysis, though reliable code execution depends on the presence of a gadget chain in the plugin, WordPress core, or other loaded components.
Unauthenticated SQL injection in the eLoanApp Platform's AJAX user-verification endpoint allows remote attackers to inject boolean- and time-based payloads into the POST parameter 'logina', enabling database engine discovery and query delays. The affected product is RDL Technologies eLoanApp Platform as represented by CPE cpe:2.3:a:rdl_technologies:eloanapp_platform:*:*:*:*:*:*:*:*, and the independent assessment scores this as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, meaning network-reachable, unauthenticated exploitation with low confidentiality, integrity, and availability impact rather than full compromise. No public exploit identified at time of analysis, and the practical risk is moderate because blind extraction is slow and noisy, making large-scale data theft time-consuming and more detectable than error-based injection.
Authenticated code execution via media upload in Kunstmaan CMS (KunstmaanBundlesCMS) before 7.3.2: the MediaBundle checks the file-extension blacklist case-sensitively but lowercases the extension before writing the file, so a backend user with media-upload rights can submit a file named e.g. webshell.pHp, slip past the blacklist, and have it stored as webshell.php inside the web-accessible media directory. Impact escalates to full remote code execution, but only where the web server is configured to execute scripts in public/uploads/media/ - the vendor's hardening guidance (disable script execution for that path, send X-Content-Type-Options: nosniff) removes the execution impact. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the flaw is gated behind a valid media-role account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.2).
Unauthenticated PHP object injection in the FC United WordPress theme (Axiom Themes, versions up to and including 1.1.1) allows remote attackers to pass crafted serialized input that the theme unserializes without validation, potentially leading to code execution, file manipulation, or database compromise depending on the gadget chains available on the host site. The 9.8 CVSS score reflects a fully remote, unauthenticated attack path with no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), but there is no public exploit identified at time of analysis and no CISA KEV listing; all severity signals are theoretical rather than empirical. Real-world impact is further bounded by CWE-502's dependency on a reachable POP gadget chain in the theme, WordPress core, or an installed plugin, and by the theme's limited deployment footprint.
Unauthenticated PHP object injection in the ThemeREX ShiftCV WordPress theme, affecting versions up to and including 3.0.14, lets remote attackers feed crafted serialized input into an unsafe deserialization sink, which can escalate to remote code execution when a usable POP gadget chain is reachable in the theme, WordPress core, or an installed plugin. The flaw carries a 9.8 Critical rating (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no authentication and no user interaction are required and successful exploitation can fully compromise confidentiality, integrity and availability. There is no public exploit identified at time of analysis and no CISA KEV confirmation, so the practical limiting factor is the availability of a reachable gadget chain rather than the injection primitive itself; no EPSS score was supplied in the available intelligence.
Unauthenticated PHP object injection in the WordPress theme Windsor (ThemeREX) through version 2.10 lets remote attackers feed crafted serialized data into an unserialize() call reachable without authentication or user interaction, scoring a maximum base 9.8 under CVSS 3.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Reported by Patchstack and tracked as CWE-502, the flaw's realized impact depends on whether a usable PHP gadget chain exists across the theme, WordPress core, and installed plugins - in an unpatched site with a suitable gadget, this can escalate to code execution, arbitrary file or data manipulation, whereas without one the injection may be largely inert. At time of analysis there is no public exploit code identified and no CISA KEV listing, so exploitation is not confirmed in the wild; no vendor-released fix version appears in the available advisory data. Given the unauthenticated, network-reachable profile and the prevalence of gadget-rich plugin stacks, this should be treated as high priority for any site running the theme.
Unauthenticated PHP object injection in the ThemeRex Education Center WordPress theme (versions up to and including 3.6.12) lets remote attackers feed serialized data into an unserialize() sink with no authentication and no user interaction, scored CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Actual damage depends on whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins, because that determines whether object injection escalates to code execution or full confidentiality, integrity, and availability loss. No public exploit code and no CISA KEV listing were identified at time of analysis, and real-world exposure is constrained by the narrow installed base of this specific commercial theme.
Unauthenticated PHP object injection in the Ancorathemes Drone Media WordPress theme, affecting all versions through 2.2.0, lets a remote attacker supply a crafted serialized PHP object to a theme-reachable sink without authentication, no user interaction, and low attack complexity, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N base vector scored 9.8. Because successful exploitation depends on a usable property-oriented programming (POP) gadget chain being present in the theme, WordPress core, or an installed plugin, the maximum C:H/I:H/A:H impact - typically code execution, file manipulation, or full site takeover - is only realized when such a chain exists; otherwise the realized impact may be lower. At time of analysis there was no public exploit code identified and no evidence of confirmed active exploitation (not listed in CISA KEV), though the combination of an unauthenticated, network-reachable, low-complexity injection sink makes this a high-priority target for attackers once a chain is publicized. Reported by Patchstack against the CPE cpe:2.3:a:ancorathemes:drone_media.
PHP object injection in WooCommerce Multilingual & Multicurrency 5.5.8 and earlier allows an authenticated user with the shop manager role (or higher) to submit crafted serialized input to a plugin endpoint, potentially leading to high confidentiality, integrity, and availability impact if a usable POP gadget chain is present in the loaded code. The vulnerability carries a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction beyond the attacker's own authenticated request, but it is not accessible to anonymous visitors or ordinary customers. No public exploit identified at time of analysis.
Unauthenticated PHP object injection in the ThemeRex 'Asia Garden' WordPress theme (versions 1.3.1 and earlier) allows remote attackers to pass crafted serialized data into PHP's unserialize() and instantiate arbitrary objects on the target site. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8 Critical), exploitation requires no authentication or user interaction against an affected installation and could yield full confidentiality, integrity, and availability impact - typically arbitrary code execution, file manipulation, or SQL injection when a usable POP gadget chain exists in the theme, WordPress core, or an active plugin. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (CISA KEV); no EPSS score was supplied. Practical exploitability hinges on the presence of a viable gadget chain, without which impact may drop to denial of service or be difficult to weaponize, and the exact vulnerable parameter/endpoint is not detailed in the available data.
Unauthenticated PHP object injection in the WordPress theme N7 | Golf Club Sports & Events (versions 2.21 and earlier, vendor ThemeREX) lets a remote attacker supply a crafted serialized PHP object to a theme endpoint without any authentication or user interaction, yielding a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Because no public exploit code and no CISA KEV entry were identified at time of analysis, real-world impact hinges on whether a usable POP gadget chain exists in the theme, WordPress core, or a co-installed plugin; where such a chain is reachable, the deserialization flaw can escalate to full remote code execution. Exposure is limited to sites that have this specific niche golf/sports theme installed and active, but for those sites the worst-case profile is complete compromise by an unauthenticated attacker.
Unauthenticated PHP object injection in the ThemeRex Invetex WordPress theme affects versions 2.18 and earlier, allowing remote attackers to supply crafted serialized input to a theme endpoint that performs unsafe deserialization. Successful exploitation can lead to full compromise of the confidentiality, integrity, and availability of the affected site, but the practical ceiling depends on whether a usable PHP POP gadget chain exists in the theme, an active plugin, or WordPress core. No public exploit code or confirmed active exploitation was identified at time of analysis, and the CVSS score should be weighed against the assessed AC:H rather than the reported AC:L.
Unauthenticated PHP object injection in the ThemeRex 'Law Office' WordPress theme at version 3.20 and earlier lets remote attackers with no credentials and no user interaction pass attacker-controlled serialized data into an unsafe unserialize() path, which the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) scores as complete loss of confidentiality, integrity and availability. Practical impact depends heavily on whether a usable POP gadget chain exists in the theme, an installed plugin, or WordPress core; without a reachable gadget the result may be far below the theoretical 9.8 headline score. No CISA KEV entry, EPSS score, or public exploit code is present in the available intelligence, so this is assessed as no public exploit identified at time of analysis, and exposure is limited to sites running this commercial legal-industry theme.
Unauthenticated local file inclusion in the KuteShop WordPress theme through version 4.2.9 allows remote attackers to read files from the hosting server - and, given the CWE-98 root cause, potentially to influence which PHP file is included - without any login or victim interaction. The issue is rated CVSS 3.1 8.1 (High) with a network vector (AV:N), no privileges (PR:N) and no user interaction (UI:N), but high attack complexity (AC:H), which indicates exploitation depends on a specific request format, parameter, or theme configuration rather than a trivial default-configuration request. Impact is high across confidentiality, integrity, and availability; no public exploit identified at time of analysis, and reports come from Patchstack, so exposure is limited to sites running this commercial theme with an affected version installed and active.
Unauthenticated local file inclusion in the Boutique WordPress theme from KuteThemes (CPE cpe:2.3:a:kutethemes:boutique) through version 2.3.3 allows a remote attacker to influence a PHP include/require path and read arbitrary local files from the web server without any login or victim interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1, CWE-98). The high attack complexity signals that exploitation is not a simple one-shot request: the attacker must craft a path that survives the theme's filtering and the target's PHP configuration (notably wrapper and allow_url_include settings) before confidentiality, integrity and availability impact materializes at the rated level. There is no public exploit code identified at time of analysis and no CISA KEV listing; the impact beyond local file disclosure - including any escalation to code execution implied by the I:H/A:H sub-scores - is conditional and not confirmed by the description. The only advisory data available is the Patchstack disclosure for the KuteThemes Boutique theme.
Unauthenticated local file inclusion in the KuteThemes Biolife WordPress theme through version 3.2.3 allows remote attackers to steer a PHP include/require path and read arbitrary files from the hosting server, exposing wp-config.php database credentials, API keys, and other sensitive content. The reported vector scores 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), but independent assessment narrows realistic impact to confidentiality loss (C:H/I:N/A:N): the attack is unauthenticated and remote, yet high-complexity because the exact vulnerable parameter, encoding, and configuration prerequisites are not documented, so a single guaranteed payload is not established. No public exploit code and no confirmed active exploitation were identified at time of analysis, and exposure is limited to the niche set of sites running this commercial theme at or below 3.2.3.
Unauthenticated local file inclusion in the TechOne WordPress theme (versions 3.0.3 and earlier) allows remote attackers to read arbitrary files from the server by supplying crafted input to a vulnerable PHP include/require statement. No public exploit code has been identified at time of analysis, and the vendor has not released a patched version. While the reported CVSS base score is 8.1, the independent assessment limits the impact to confidentiality (C:H) with high attack complexity (AC:H) and no confirmed escalation to code execution, so real-world priority is moderate despite the high score.
Local file inclusion in the Armania WordPress theme (versions up to and including 1.4.8) allows unauthenticated remote attackers to read arbitrary files on the underlying server, potentially exposing sensitive data such as wp-config.php. The vulnerability stems from improper handling of user-supplied input passed to a PHP include/require statement (CWE-98). No public exploit code or active exploitation has been reported at time of analysis; the vendor rates it 8.1 with high attack complexity, while our assessment confirms network reachability with no authentication or user interaction but notes a non-trivial precondition is required for reliable exploitation.
Unauthenticated PHP object injection in the ThemeRex WineShop WordPress theme (all versions up to and including 3.20) lets remote attackers push attacker-controlled serialized data into a PHP unserialize() operation, enabling instantiation of arbitrary PHP objects and - where a usable gadget chain exists in the theme, co-installed plugins, or the runtime - remote code execution, arbitrary file read/write, or SQL injection. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N), meaning exploitation against a default installation requires no authentication and no user interaction, per the published PR:N/UI:N vector. At time of analysis there is no public exploit code identified and the theme is not listed in CISA KEV; practical exposure is limited to sites actually running this niche wine-shop theme and by whether an exploitable POP gadget chain is reachable.
Unauthenticated PHP object injection in the ThemeRex Equadio WordPress theme (versions up to and including 1.1.4) allows remote attackers to supply crafted serialized input to vulnerable deserialization entry points, potentially leading to remote code execution, file deletion, or other high-impact outcomes depending on available gadget chains. The flaw carries a CVSS 3.1 base score of 9.8, reflecting network exploitability with low complexity, no authentication, and no user interaction required. No public exploit code or active exploitation has been identified at time of analysis, though the severity and ease of exploitation make prompt patching critical.
Unauthenticated PHP Object Injection in the ThemeRex 'Juno' WordPress theme affects all versions up to and including 2.25, allowing remote attackers to supply a crafted serialized PHP object that the theme deserializes without validation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) rates this as a network-reachable, low-complexity flaw requiring no credentials and no user interaction, with high confidentiality, integrity and availability impact; however, real-world impact depends on whether a usable POP gadget chain exists in the theme or in co-installed plugins, which is not confirmed in the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis (Patchstack is credited as the reporting source), and exploitation is limited to the subset of WordPress sites running this specific commercial theme at an affected version.
Unauthenticated PHP object injection in the BoldThemes Avala WordPress theme at version 1.1.4 and earlier lets remote attackers pass attacker-controlled data into PHP's unserialize() through a publicly reachable code path, with no authentication or user interaction required (CVSS 3.1 base 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Real-world impact - remote code execution, arbitrary file read/write/delete, or SQL injection - depends on the presence of a usable POP/gadget chain in the theme itself, WordPress core, or another installed plugin; without such a chain the injection may be inert, so the 9.8 score represents a worst-case profile rather than a guaranteed outcome. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation requires the Avala theme to be installed and active at version 1.1.4 or below.
Unauthenticated PHP object injection in the Kalles WordPress theme (versions up to and including 1.1.7.1) allows a remote attacker to pass crafted serialized data into a PHP unserialize() call, which on a site that loads a usable gadget chain can escalate to full compromise of the WordPress installation - sensitive data theft, arbitrary content or code modification, and denial of service. The CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) describes a network-reachable, low-complexity flaw requiring no credentials and no user interaction, consistent with the CWE-502 classification, and no public exploit has been identified at time of analysis. Real-world impact is bounded by gadget availability in the surrounding WordPress core, plugins, and bundled libraries, so not every installation will reach the full high-confidentiality/integrity/availability outcome.
Unauthenticated local file inclusion in the WordPress Backhoe theme (versions 2.0 and earlier, vendor 'mymoun') lets remote attackers cause a server-side PHP include/require construct to load a file path they influence, exposing sensitive local files such as wp-config.php and disclosed configuration data. The supplied CVSS vector is AV:N/AC:H/PR:N/UI:N, and the independent assessment scores confidentiality only (C:H/I:N/A:N), so the practical impact is information disclosure rather than code execution or data modification, with the high attack-complexity component reflecting an unnamed precondition (the specific vulnerable parameter, endpoint, or environment configuration) that must be derived from the Patchstack advisory. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation is limited to sites actually running this low-popularity theme, and sites on a patched release or not using Backhoe are unaffected.
Unauthenticated local file inclusion in the Ozeum WordPress theme (ThemeREX) through version 1.3.0 allows remote attackers to control a PHP include/require path and read arbitrary files on the hosting server, potentially exposing wp-config.php database credentials, API keys, and other sensitive content. Patchstack reports this as a High-severity issue at CVSS 8.1, while the independent assessment keeps attack complexity High (AC:H) and lowers integrity and availability impact to Low (C:H/I:L/A:L), meaning reliable exploitation hinges on conditions the attacker does not fully control and the realistic exposure is confined to sites running this specific theme at or below 1.3.0. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated local file inclusion in the Flipmart WordPress theme (versions up to and including 2.8, published by ckthemes) allows remote attackers to force the theme's PHP code to include and disclose files on the underlying server. The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N per this assessment) confirms no authentication (PR:N) and no user interaction (UI:N) are needed, but the high attack-complexity rating indicates exploitation depends on specific request parameters, path-traversal or stream-wrapper encoding, or particular PHP/server configuration rather than succeeding against every deployment. The primary demonstrated impact is confidentiality loss (arbitrary file read); escalation to code execution would require includable attacker-influenced content such as logs or uploads and is not established by the available data. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no vendor-released patch has been identified; a Patchstack advisory documents the issue.
Unauthenticated local file inclusion in the CocoBasic Fabius WordPress theme (versions 1.0 and earlier) allows remote attackers to read arbitrary files on the server via crafted requests that reach an include/require statement. The assessed impact is limited to confidentiality (no integrity or availability impact), and the high attack complexity (AC:H) means successful exploitation depends on specific request crafting and server configuration, such as the presence of poisonable files or permissive PHP wrappers. No public exploit code has been identified and the theme's small deployment footprint further reduces risk, making this a moderate-priority issue.
Unauthenticated local file inclusion in the Teoro WordPress theme (CocoBasic) at versions 1.1 and below lets a remote attacker induce the theme's PHP code to include a locally present file - most critically wp-config.php - exposing database credentials and salts that can be reused to take over the site. The vulnerability requires no credentials (PR:N) and no user interaction (UI:N), but the CVSS AC:H metric indicates a meaningful precondition outside the attacker's direct control (for example a specific request/encoding state or environment configuration), and exposure is limited to sites actively running this specific theme at a vulnerable version; there is no CISA KEV listing and no public exploit identified at time of analysis. The published base score is 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while the assessed vector lowers integrity and availability impact to L, so real-world risk skews toward moderate rather than critical.
Unauthenticated local file inclusion in the CocoBasic Kaven WordPress theme (versions 1.2 and earlier) allows remote attackers to cause the theme to include and output files from the underlying server, exposing sensitive content such as wp-config.php, credential files, and other data outside the web root. The affected population is limited: Kaven is a niche commercial WordPress theme, so exposure is small compared with core WordPress or high-volume plugins, and no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV. Exploitation is not trivial despite the unauthenticated vector - the CVSS AC:H rating and our independent assessment indicate a required non-default precondition or non-deterministic element (for example a specific theme parameter or feature being reachable, knowledge of an absolute file path, or particular PHP configuration such as allow_url_include) that the public advisory does not fully detail.
Unauthenticated local file inclusion in the Volos WordPress theme (versions 1.2 and below, published by CocoBasic) allows remote attackers to influence a PHP include/require path and pull in arbitrary local files on any site running the affected theme. The vulnerability is network-reachable with no authentication and no user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), but the high attack complexity score indicates a non-trivial precondition - a specific configuration, path, or environmental state - must be satisfied for reliable exploitation, and the affected installed base is limited to sites actively running Volos. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so exploitation is expected to be opportunistic rather than mass-campaign driven.
Unauthenticated local file inclusion in CocoBasic's Cardea WordPress theme (version 2.3 and earlier) lets remote attackers feed attacker-influenced input into a PHP include/require path, exposing arbitrary local files and - per the assessed vector's high integrity impact - potentially enabling code execution or file tampering if the right secondary conditions are met. The flaw needs neither authentication (PR:N) nor user interaction (UI:N), but the high attack complexity (AC:H) indicates a non-trivial precondition or configuration-dependent circumstance that the single Patchstack advisory does not spell out, so reliable exploitation against every default install is not guaranteed. Exploitation is bounded by the requirement that the Cardea theme be installed and active, there is no evidence of active exploitation (not in CISA KEV) and no public exploit identified at time of analysis, making this a moderate-priority issue rather than an emergency.
Unauthenticated PHP object injection in the ThemeRex 'Yacht Rental' WordPress theme affects all versions up to and including 2.6, allowing a remote attacker to pass crafted serialized data into a PHP deserialization path without credentials or user interaction. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the theoretical worst case is high confidentiality, integrity, and availability impact with a 9.8 base score. No public exploit code has been identified at time of analysis, and the practical severity depends on whether a usable PHP gadget chain exists within the theme, WordPress core, or co-installed plugins - without such a gadget, real-world impact may be reduced.
Unauthenticated PHP Object Injection in the Wine House WordPress theme (version 3.20 and earlier, distributed by ThemeREX) allows a remote attacker to deliver a crafted serialized payload to an unserialize() call, which the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) rates at 9.8 Critical with full Confidentiality, Integrity, and Availability impact. Because PR:N and UI:N are confirmed by the vector, no authentication or victim interaction is required - any unauthenticated request to the affected endpoint against a site with the theme installed and active can carry the payload. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical severity is bounded by whether a usable POP gadget chain exists in the theme, WordPress core, or co-installed plugins; absent such a gadget, impact may degrade to denial of service or be non-exploitable, and the target population is limited to sites running this single commercial theme.
Unauthenticated PHP object injection in the ThemeREX Tipsy WordPress theme through version 1.6 allows remote attackers to supply crafted serialized data that the theme passes to PHP unserialize(), potentially leading to remote code execution, file manipulation, or SQL injection where a usable POP gadget chain exists. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N), the flaw is network-reachable, low-complexity, and requires neither authentication nor user interaction, with full confidentiality, integrity, and availability impact (9.8). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; exploitation is constrained by the need for an exploitable gadget chain in the theme, WordPress core, or an active plugin.
Unauthenticated PHP object injection in the Stargaze WordPress theme (versions 1.10 and earlier) allows remote attackers to submit a crafted serialized payload that the theme feeds to PHP's unserialize(), which can trigger arbitrary object instantiation and, where a usable gadget chain is present, code execution or full site compromise; the maximum-base CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact. Per that vector no authentication (PR:N) and no user interaction (UI:N) are required, and the CPE record cpe:2.3:a:themerex:stargaze ties the exposure to the ThemeREX Stargaze theme, so only sites with this theme installed and active are in scope. At time of analysis there is no public exploit identified, and the practical ceiling on impact depends on whether a viable POP gadget chain exists in the theme itself, a co-installed plugin, or WordPress core.
Unauthenticated PHP object injection in the ThemeRex Splendour WordPress theme (versions 1.23 and earlier) lets remote attackers pass crafted serialized data into an unsafe deserialization routine, which can lead to remote code execution, arbitrary file manipulation, or full site takeover if a usable gadget chain is reachable. The flaw carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is classified as CWE-502 Deserialization of Untrusted Data; the vector confirms the entry point is reachable over the network with no authentication and no user interaction. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited, so real-world impact hinges on the presence of a POP gadget chain in the theme, co-installed plugins, or WordPress core, and on the narrow deployment footprint of this specific commercial theme.
Unauthenticated local file inclusion in the DirectoryPress WordPress plugin (versions up to and including 3.6.27) allows any remote attacker to read arbitrary files on the hosting server, exposing items such as wp-config.php with database credentials and authentication salts. The reporter's CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, base 9.8) reflects a fully remote, unauthenticated, low-complexity attack requiring no user interaction, and the plugin's modest deployment footprint is the main practical limit on exploitation rather than any configuration prerequisite. No public exploit code and no confirmed active exploitation were identified at time of analysis; independent review narrows realistic impact to confidentiality loss (C:H/I:N/A:N), with escalation to code execution dependent on unconfirmed server conditions such as writable log or session files and PHP wrapper availability.
PHP object injection in the Angio WordPress theme (versions 1.1.1 and earlier) allows authenticated attackers with Subscriber-level access to supply malicious serialized data, potentially achieving remote code execution, file manipulation, or other high-impact outcomes if a usable gadget chain exists in the theme, plugins, or WordPress core. Exploitation requires an authenticated Subscriber account (CVSS vector PR:L), which is often obtainable through open user registration, and no public exploit code or active exploitation has been identified at time of analysis. This is a priority-worthy flaw but not an emergency, as practical impact is contingent on the presence of a gadget chain.
Unauthenticated local file inclusion in the Mikado Themes 'TouchUp' WordPress theme (all versions below 1.4) lets remote attackers reach a PHP file-inclusion routine without any credentials or user interaction, exposing arbitrary files on the web server. Our assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N - confidentiality-only impact with high attack complexity, meaning successful exploitation depends on specific request conditions, path constraints or server configuration and is not guaranteed against every default install. Impact is confined to self-hosted WordPress sites running this specific theme, and no public exploit code or confirmed active exploitation was identified at time of analysis; the vendor-released fix is TouchUp 1.4.
Local file inclusion in KuteThemes DukaMarket WordPress theme through version 1.3.0 allows a remote unauthenticated attacker to read arbitrary local files on an affected web server, though the independent assessment limits impact to confidentiality only (C:H/I:N/A:N) rather than integrity or availability. Successful exploitation is constrained by high attack complexity (AC:H), typically requiring a specific traversal or filter-bypass condition, and real-world exposure is limited to WordPress sites running this theme. No CISA KEV entry is present, no public exploit identified at time of analysis, and no EPSS score is supplied; the submitted CVSS 8.1 appears to reflect high integrity/availability impact that the independent assessment does not confirm.
Unauthenticated local file inclusion in the Uminex WordPress theme from Kutethemes affects every release up to and including 1.0.9, allowing a remote attacker who can reach an affected installation to supply crafted input to a PHP file-inclusion code path and read files from the underlying server. Patchstack published the issue at CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), whereas our independent assessment narrows the realistic outcome to disclosure of local files only (C:H/I:N/A:N) with a lower attack complexity, so integrity and availability impact should not be assumed without a demonstrated exploit. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with the intelligence; the signals are mixed and point to moderate rather than emergency priority.
Unauthenticated local file inclusion in the Aalto WordPress theme (vendor Edge Themes) at versions 1.8 and earlier allows remote attackers to steer the theme's PHP include/require logic toward attacker-influenced file paths, producing the high confidentiality, integrity, and availability impact reflected in the assessed CVSS of 8.1. The vector is AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, so no authentication or user interaction is required but a non-default precondition - such as a specific request parameter, a reachable theme code path, or includable content the attacker can reference - must be satisfied for exploitation to succeed, which is why the issue is context-dependent rather than universally exploitable. Exposure is limited to sites actively running the Aalto theme at 1.8 or below; there is no public exploit identified at time of analysis and the theme is not confirmed actively exploited (no CISA KEV listing).
Unauthenticated local file inclusion (LFI) in the CleanSkin WordPress theme versions 1.5.0 and earlier allows remote attackers to include and potentially execute arbitrary local files, leading to information disclosure or, under specific conditions, code execution. The CVSS score is 8.1 (High), but exploitation requires high attack complexity (AC:H) and the exact vulnerable parameter or endpoint is not disclosed, so the practical risk is tempered. No public exploit code exists at time of analysis, and the Patchstack advisory does not specify a fixed version.
Unauthenticated PHP object injection in the Ancora Themes CleanSkin WordPress theme (versions up to and including 1.5.0) allows remote attackers to pass attacker-controlled serialized data into an endpoint that deserializes it, as reflected by a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vector confirms the attack is network-reachable, low-complexity, and requires neither authentication nor user interaction against reachable installations, though real-world impact hinges on the presence of a usable POP gadget chain in the theme, WordPress core, or co-installed plugins - without one, the outcome may be limited to the injection itself. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing was provided); the available data contains no documented fixed version.
PHP object injection in the Dynamic User Directory WordPress plugin (versions 2.4 and earlier) allows an attacker holding a low-privileged account to feed attacker-controlled serialized data into an unserialize() call, potentially enabling arbitrary file operations, data disclosure, or remote code execution if a usable POP gadget chain exists within the plugin, WordPress core, or a co-installed plugin. The supplied CVSS 3.1 vector scores 9.8 (AV:N/AC:L/PR:N/UI:N), but our independent assessment lowers the privileges-required metric to Low (PR:L) because the Patchstack 'Subscriber' designation means the attacker must already hold a subscriber-level WordPress account; sites that disable open user registration substantially limit exposure. No public exploit code or confirmed active exploitation was identified at time of analysis.
Unauthenticated PHP object injection in Booster for WooCommerce (WordPress plugin slug woocommerce-jetpack, vendor pluggabl) at version 8.4.0 and earlier allows remote attackers to feed attacker-controlled serialized data into the plugin's deserialization path on any internet-facing WordPress/WooCommerce site, with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical) indicating no credentials, no user interaction, and no non-default configuration are required. Escalation to full remote code execution depends on whether a usable PHP POP gadget chain is reachable in the plugin or other loaded code at the point of unserialization, so the practical worst case is complete site compromise while the minimum case is a deserialization primitive with uncertain downstream effect. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; Patchstack is credited as the reporter.
Unauthenticated PHP object injection in Payever WooCommerce Gateway versions up to 4.8.2 allows remote attackers to pass serialized input to an unsafe PHP deserialization path, with a CVSS 3.1 base score of 9.8 reflecting potential full confidentiality, integrity, and availability impact on affected WordPress/WooCommerce sites. The issue is CWE-502 and is network-reachable with low complexity and no privileges or user interaction; no public exploit identified at time of analysis. Practical exploitation may depend on the presence of a usable POP gadget chain, so the real-world outcome can range from limited object injection to full code execution or other high-impact actions.
Local file inclusion in the Kids Care WordPress theme through version 3.2.4 allows unauthenticated remote attackers to manipulate a file-inclusion parameter and read local server files, with wp-config.php and other readable files as the primary exposure. The base CVSS vector is 8.1 with High Attack Complexity, but the independent assessment keeps the same unauthenticated and no-user-interaction prerequisites while bounding realistic impact to confidentiality-heavy local file disclosure with Low integrity and availability impact unless log poisoning or PHP wrappers enable escalation. No CISA KEV activity is identified in the provided data, and no public exploit identified at time of analysis; the independent assessment rates this as a credible but not top-tier priority.
Command execution in Spotweb through 1.5.8 can be triggered through the optional runcommand NZB handler when malicious Usenet spots carry shell metacharacters in their titles; a Spotweb user then has to download the spot so the unescaped title is substituted into $SPOTTITLE and passed to exec(). Exploitation does not require Spotweb authentication, but it is conditional on the runcommand handler being enabled and on passive victim interaction, and code runs with the privileges of the Spotweb PHP process. Publicly available exploit code exists, though no CISA KEV active exploitation is reported; instances without the runcommand integration are not exposed through this path.
Information disclosure in Open Source Social Network (OSSN) through 10.1 allows authenticated users to read other users' private message attachments by requesting the /messages/attachment/{guid} route with sequential or guessed file GUIDs. The flaw is an insecure direct object reference (CWE-639) in the default attachment handler, which outputs a file whenever it is typed as a message attachment without verifying that the requesting user is the sender or recipient; no user interaction is required, but a valid low-privileged account and a valid attachment GUID are needed. Publicly available exploit code exists (a HackMD writeup), and a vendor-linked fix commit is referenced, though a released patched version is not independently confirmed, and there is no indication of confirmed active exploitation (CISA KEV).
Unauthenticated remote attackers can delete arbitrary files on WordPress/WooCommerce sites running the PPOM - Product Addons & Custom Fields for WooCommerce plugin through version 34.0.10, abusing insufficient path validation in the rename_files function that is reachable via the plugin's cart/order file-handling path. Removing critical files such as wp-config.php can push the site into a re-installation state that is readily leveraged for remote code execution, and because the relocated file is moved byte-identically into the web-accessible wp-content/uploads/ppom_files/confirmed/ directory, the same flaw also exposes arbitrary file read for anything the web server user can read. Wordfence rates it 9.1 and independent assessment confirms CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, i.e. no authentication, privileges, or user interaction required against default internet-exposed configurations; no public exploit code has been identified at time of analysis. This is a genuine high-priority issue, not a CVSS-inflated one, with the main precondition being simply that the vulnerable plugin version is installed, active, and serving requests.
PHP Object Injection in the Bookly (Online Scheduling and Appointment Booking System) WordPress plugin, affecting all versions up to and including 28.2, lets authenticated users with Bookly 'custom-level' access or above pass a serialized payload through the plugin's 'value' parameter, which is then deserialized without validation; a successful chain could yield high confidentiality, integrity and availability impact. The decisive limiting factor is that no known gadget chain is available, so exploitation depends on a compatible gadget existing in another installed plugin, theme, or WordPress core, meaning default installations without such a gadget face injection without a direct exploit path. The flaw is not reachable by anonymous visitors (authentication required), and no public exploit code or CISA KEV entry has been identified at time of analysis.
Stored cross-site scripting in the Post Grid Gutenberg Blocks - PostX WordPress plugin, affecting all versions up to and including 5.1.0, allows an attacker holding a Subscriber-level account to plant JavaScript in the user display_name field that executes for any visitor viewing a page where the plugin renders its Archive Title block. The bypass works because WordPress core's pre_user_display_name filter uses ENT_NOQUOTES, encoding ampersands, angle brackets and greater-than signs but leaving double-quotes intact, so a crafted display_name breaks out of the alt="" attribute at Archive_Title.php:144. Reported by Wordfence with a CVSS v3.1 base score of 7.2; no public exploit identified at time of analysis, though the published CVSS vector claims PR:N while our assessment holds PR:L, since the attack requires an authenticated Subscriber-or-higher account created through open registration or an attacker-controlled low-privilege user.
Authenticated remote code execution in Rank Math SEO before 1.0.280 is possible because the WordPress plugin's settings import feature fails to validate uploaded file types, allowing an administrator to upload a PHP file for server-side execution. The CVSS vector is network-reachable but requires high privileges (PR:H), so an attacker must already hold administrator-level WordPress access; no public exploit was identified at time of analysis, and the vendor has released a patch. While the 7.2 base score looks significant, the administrator prerequisite makes this a comparatively low-real-risk issue for most deployments.
PHP Object Injection in LifterLMS through 10.2.1 requires an authenticated user with the edit_course capability-such as Instructor, Instructor's Assistant, LMS Manager, or Administrator-and is reachable only during lesson creation when a temporary lesson ID enters the custom metadata path in class.llms.admin.builder.php. Although rated high at CVSS 8.8, the plugin contains no POP gadget chain, so exploitation has no impact unless a separate installed plugin or theme provides a usable POP chain; if such a chain exists, an attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on the chain. No public exploit code or confirmed active exploitation was identified at time of analysis.
Local file inclusion in the GeoDirectory - WP Business Directory Plugin and Classified Listings Directory for WordPress (all versions up to and including 2.8.187) allows unauthenticated remote attackers to pass a crafted 'design_type' parameter through the plugin's tags-widget AJAX path and force the server to include attacker-chosen .php files, which the plugin's own geodir_basic_nonce does not meaningfully impede because that nonce is localized into the geodir_params script object on every public frontend page. The immediately attainable impact is access-control bypass and disclosure of sensitive server-side data, while full arbitrary PHP code execution is conditional on an attacker-controllable .php file already existing on the server or being uploadable to it; the independent assessment rates the vector as AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact, and no public exploit identified at time of analysis. Versions 2.8.188 and later are not affected because design_type is restricted to a fixed allowlist and template names are validated against directory traversal and null bytes.
Code injection in the Fastcache by Host.it WordPress plugin (all versions up to and including 1.7.4) allows an authenticated administrator-level user to write arbitrary Apache directives into the site's .htaccess file, which can be escalated to full remote code execution by setting php_value auto_prepend_file to load attacker-controlled PHP on every request. Exploitation requires the PR:H vector from the assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H score (7.2), i.e. a logged-in account with administrator privileges, and is further conditioned on the site running Apache with an .htaccess file the plugin can write and an AllowOverride configuration that honors php_value directives - on nginx or Apache with AllowOverride None the injected directives have no effect. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV; this is a genuine but access-gated privilege-to-RCE escalation rather than a mass-exploitable perimeter bug.
Unauthenticated remote code execution affects Expivi 3D Product Configurator for WooCommerce through version 2.16.2. Missing authentication and nonce checks on the wp_loaded handler, combined with unsanitized xpv_image POST input echoed into a Dompdf-rendered .phtml template with PHP execution enabled, lets any remote attacker execute code on the server. No public exploit identified at time of analysis; CVSS 9.8 and CWE-434 indicate critical, unauthenticated risk.
Unauthenticated arbitrary file upload in the WordPress plugin Extensions For CF7 (Contact Form 7 Database, Conditional Fields and Redirection) versions up to and including 3.4.5 allows remote attackers to write attacker-controlled files into the site's upload directory through the plugin's signature field, with remote code execution as the likely outcome. The flaw is reachable via the extcf7_submit function without authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, 9.8) but only on sites that have a Contact Form 7 form actually using the plugin's signature field; sites not exposing that field are not reachable through this vector. At time of analysis no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), and the vendor has released a fix in version 3.4.6, so the exposure window is bounded by how quickly affected sites update.
Stored cross-site scripting in the Contao CMS comments bundle lets an unauthenticated visitor submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php, so attacker-controlled script executes in the Contao backend origin when a backend user opens the Comments module. All Contao releases from 4.0.0 up to (but not including) 5.3.50 and 5.7.12 are affected, and successful exploitation requires a privileged backend user to view the Comments module (CVSS 9.3, AV:N/AC:L/PR:N/UI:R/S:C); no public exploit code has been identified at time of analysis and there is no indication of confirmed active exploitation. Critically, moderation is not a mitigating control because unpublished/pending comments remain visible to moderators, so an unapproved malicious comment still triggers in that user's session.
Remote code execution in ILIAS LMS versions before 9.24, 10.12, and 11.5 lets an authenticated author who holds question-pool (QTI) import rights upload a crafted question-import archive that writes a .htaccess file plus a PHP payload into the web-served image directory, resulting in code execution as the web server user. The defect is an unrestricted file upload (CWE-434) in the QTI image-handling security class ilQtiMatImageSecurity, reached through the standard question import path with no non-default configuration required. Exploitation requires a legitimate, permissioned authoring account rather than anonymous access, no public exploit code has been identified at time of analysis, and vendor-released fixes are available in 9.24, 10.12, and 11.5; instances that limit QTI import rights to vetted staff face materially lower realistic risk.
Account takeover in PHPNuxBill through 2025.3.20 allows unauthenticated remote attackers who know a valid customer username to brute-force the six-digit otp_code in the customer password-reset flow at system/controllers/forgot.php; because the pre-patch code has no attempt limit or lockout, an attacker can guess the OTP within its roughly 600-second validity window and then read the newly set password from the HTTP response. The vendor has published an upstream fix and advisory, but no public exploit identified at time of analysis, and the independent assessment rates this as a genuine high-priority issue requiring only a known username and default configuration.
Unauthenticated SQL injection in the PHPNuxBill radius.php FreeRADIUS REST endpoint allows remote attackers to read arbitrary data from the application database - including customer records and stored credentials - by injecting crafted username, macAddr, or nasid parameters into the accounting or authenticate actions, which are interpolated directly into whereRaw() queries. All versions through 2025.3.20 are affected per the vendor advisory and CPE data (cpe:2.3:a:hotspotbilling:phpnuxbill:*:*), and exploitation requires only network reachability of radius.php, with no authentication and no user interaction. The supplier-scored CVSS 4.0 vector (9.3) asserts high confidentiality, integrity, and availability impact, whereas our independent assessment scopes the realistic impact to confidentiality loss (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N); no public exploit code or confirmed active exploitation was identified at time of analysis, so the decisive risk factor is whether radius.php is exposed beyond the trusted RADIUS/NAS segment.
Path traversal in KodExplorer before 4.55 lets an authenticated low-privileged user bypass the archive-extraction sanitizer and write files anywhere on the server by uploading a ZIP archive containing crafted names such as '....//'. Because the overwritten files can include core JavaScript assets, the flaw chains into stored XSS that can lead to administrator account takeover and, ultimately, remote code execution through unrestricted PHP file upload. Exploitation requires a valid low-privileged account and use of the unzip functionality, so this is a credible, actionable priority rather than a drop-everything emergency; no public exploit code has been identified at time of analysis and no CISA KEV entry confirms active exploitation, while a vendor patch is available in release 4.55.
Stored cross-site scripting and potential remote code execution in HortusFox (hortusfox-web) through version 6.3 allow authenticated users to upload files with client-supplied extensions via the plant attachment feature, which are stored under the web-accessible public/attachments/ directory. Uploaded HTML or SVG files lead to stored XSS when a victim opens them, while uploaded PHP files can execute code on servers where .htaccess restrictions are unenforced, though this RCE path requires a non-default misconfiguration. No public exploit code has been identified at time of analysis, although a public technical write-up demonstrating the stored XSS is referenced. The CVSS 4.0 base score is 7.7 (High), and an independent CVSS 3.1 assessment rates it High with C:H/I:H/A:H.
Local file inclusion in the Fuelthemes The Voux WordPress theme through version 6.9.5 lets unauthenticated remote attackers induce the server to include attacker-influenced local files - with possible escalation to PHP code execution if parseable content can be placed or referenced on the host - by reaching an undisclosed include/require code path (CVSS 3.1: 8.1, AV:N/AC:H/PR:N/UI:N). The high attack-complexity value indicates exploitation is not trivial and depends on a condition the Patchstack advisory does not disclose (likely a specific request parameter feeding a theme include/require call, or a particular theme function or page being active). No public exploit code and no confirmed active exploitation were identified at time of analysis, so this should be treated as a genuine but second-tier priority for sites running The Voux 6.9.5 or earlier.
Local file inclusion in the Fuelthemes Werkstatt WordPress theme (all versions through 4.8.3) allows unauthenticated remote attackers to route unsanitized input into a PHP include/require statement, exposing server-side files such as wp-config.php and potentially escalating to code execution if an attacker-controlled file can be placed on the target. The issue is rated CVSS 8.1 (High) under CWE-98; no public exploit code and no confirmed active exploitation were identified at time of analysis. Attack complexity is High (AC:H) because meaningful impact depends on server configuration and on an attacker-controllable includable path, and sites not running Werkstatt or already updated past 4.8.3 are not affected.
Remote code execution in the AWP Classifieds WordPress plugin before 4.4.9 allows an authenticated user holding the plugin's management capability to import a crafted ZIP archive whose contents are extracted without file-type validation, planting arbitrary PHP into a publicly accessible, network-shared directory. Because the extraction target is web-reachable, the uploaded PHP can be requested and executed, yielding code execution under the web server account. Exploitation is gated by the required management capability (CVSS PR:L), and a vendor patch is available in 4.4.9; publicly available exploit code exists and EPSS is low at 0.19% (8th percentile), with no CISA KEV listing indicating confirmed active exploitation. CWE-434 (unrestricted upload of a file with a dangerous type) is the root cause class.
Deeply nested GraphQL documents can crash PHP worker processes running the webonyx/graphql-php library in versions 15.32.2 and earlier, because the recursive-descent parser has no recursion depth limit and the resulting stack exhaustion becomes an uncatchable SIGSEGV. The flaw is remotely reachable unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 8.2) and the failure occurs during parsing, before query validation, depth analysis or complexity controls ever execute, so worker processes on PHP-FPM, Swoole, RoadRunner, ReactPHP or CLI runtimes are killed with no exception, log entry or recovery path. The vendor has released a fix in 15.32.3 that enables a default recursion limit of 256; there is no KEV listing and no public exploit identified at time of analysis, though the upstream advisory documents a minimal crashing payload of roughly 74 KB, which is below common HTTP body-size limits.
Server-side request forgery (SSRF) in the Malcolm file-upload component allows authenticated low-privilege attackers to force the server to download arbitrary URLs via the unmodified upstream FilePond PHP fetch API route, then read back the fetched content through the transfer directory. The flaw, identified as CWE-918, affects Malcolm deployments using the file-upload feature and can expose internal network services or cloud metadata due to curl's FOLLOWLOCATION behavior. No public exploit identified at time of analysis; exploitation requires access to the upload endpoint (PR:L), and impact is limited to confidentiality readback plus minor availability (storage consumption).
Malcolm, CISA's open-source network traffic analysis platform, ships an nginx-based reverse proxy whose Lua RBAC authorization layer and nginx's request routing normalize crafted URL paths differently, letting an authenticated user at any privilege level slip past role-based restrictions and reach administrative or role-gated endpoints. Rated CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N), the flaw yields high confidentiality and integrity impact against every RBAC-protected path - file upload, the PHP server, htadmin, and authentication management interfaces - while requiring only network reachability plus a valid low-privilege account (PR:L), with no user interaction. There is no public exploit identified at time of analysis and no confirmed CISA KEV listing, but the low credential bar and the sensitivity of the exposed interfaces make this a genuine priority rather than a CVSS-inflated paper risk.
Remote code execution in ILIAS LMS (before 9.24, 10.x before 10.12, and 11.x before 11.5) allows an authenticated user with test-question authoring rights to inject ImageMagick convert options through the filename of an uploaded image in an image-map question. Because escapeshellcmd() does not neutralise tab characters, an author can smuggle extra command arguments that instruct convert to drop a PHP file under the web root, which is then executable by any visitor and yields remote code execution on the server. Exploitation requires a tutor/instructor-level account with access to assImagemapQuestionGUI, no public exploit code has been identified at time of analysis, and a vendor patch is available.
Two-factor authentication bypass in pH7Builder (pH7 Social Dating CMS) before 18.5.0 lets attackers who already know a valid account password brute-force the 6-digit TOTP code submitted to VerificationCodeFormProcess.php without any attempt throttling, ultimately taking over member, affiliate, or administrator accounts. Exploitation is second-order: it requires prior credential compromise (PR:L) plus 2FA enabled on the target account, and success depends on racing the OTP rotation window (AT:P), but when those conditions hold nothing stops unlimited guesses. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vendor has shipped a fix in version 18.5.0 that reuses the existing per-IP login-attempt lockout.
An authenticated low-privileged member of a pH7Builder (pH7 Social Dating CMS) site running a version before 18.5.1 can upgrade themselves to the most expensive paid membership tier without paying the corresponding price. The payment controller trusts client-supplied plan and amount parameters - specifically item_number, cart_order_id, and the PayPal 'custom' field - so an attacker can pay a token amount (or submit an uncompleted PayPal IPN notification) and still be granted the highest tier and all of its paid features. The flaw requires a valid member account (CVSS 4.0 PR:L) and an instance that actually sells paid tiers through an enabled gateway, notably PayPal; no public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a fix in 18.5.1.
Quadratic-time denial of service in league/commonmark 2.0.0 through 2.10.1 lets unauthenticated remote attackers exhaust PHP worker CPU by submitting a single large Markdown paragraph made of pipe-free lines that do not begin with a letter, which forces the GitHub Flavored Markdown Table extension's TableStartParser::tryStart() to rescan the entire growing paragraph buffer on every line. Successfully exploited, this drives seconds to tens of seconds of single-core CPU per request that scales with the square of the input size, enough to saturate worker pools and deny service to other users. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), and no public exploit code was identified at time of analysis, though the attack is trivially derived from the published advisory; impact is limited to availability with no confidentiality or integrity effect, and only applications that render untrusted Markdown with the Table extension enabled are affected.
Unauthenticated blind SQL injection in the NetBoard CRM demo platform lets remote attackers read and modify backend database contents by sending a crafted POST request to the password-recovery endpoint /module/auth/recovery.php, where the 'user-name' parameter is passed unsafely into a SQL query. The flaw carries a maximum-severity CVSS 4.0 base score of 10.0 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L), so no credentials, user interaction, or non-default configuration are needed; the practical limiting factor is whether an instance of this specific demo application is reachable from the internet, since it is a demonstration platform rather than a widely deployed production CRM. No public exploit code has been identified at time of analysis, and no CISA KEV entry or EPSS score was supplied, so active exploitation is not confirmed; exploitation is demonstrated through Boolean, error-based, time-based, and UNION query techniques.
Unauthenticated arbitrary file upload in the Bricksforge plugin for WordPress (all versions up to and including 3.1.8.9) lets a remote attacker plant a PHP payload in the upload directory and execute it, resulting in complete compromise of the affected WordPress site (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The attack chain abuses the plugin's public 'bricksforge_regenerate_nonce' AJAX endpoint to obtain a valid nonce without credentials, uploads a GIF/PHP polyglot through the temporary file-upload path where MIME checks are actually performed, then re-submits a form whose 'temporaryFileUploads' parameter points at the already-validated file while the attacker-controlled 'url' field forces a .php extension on the final write. No authentication, interaction, or non-default configuration is required beyond an installed and active vulnerable plugin on a server that executes PHP from the upload location; no public exploit code was identified at time of analysis.
Unauthenticated account takeover, including full administrator compromise, affects WordPress sites running the Frontend Dashboard plugin versions 3.0.0 up to but not including 3.0.5. Missing authorization and nonce checks on actions available to unauthenticated users allow an attacker to invoke an arbitrary PHP function or class method with attacker-controlled arguments, resulting in complete loss of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited (CISA KEV); the vendor has released a patch in version 3.0.5.
PHP object injection in the WordPress plugin Uncanny Automator - AI + Automation for WordPress (all versions up to and including 7.6.1.1) lets an authenticated attacker with Subscriber-level access or above pass attacker-controlled data into an unserialize() sink via recipe trigger meta, and a POP chain present in Uncanny Automator itself escalates that into deletion of arbitrary files on the server. Exploitation is conditional rather than trivial: it additionally requires at least one supported third-party integration plugin (PeepSo, MailPoet, WPForms, and similar) to be co-installed and a recipe to be configured so that attacker-supplied input is stored as trigger meta - a combination of prerequisites that is why the assessed vector is AC:H and the plugin's real-world exposure is best characterized as a genuine but conditional risk rather than a mass-exploitation emergency. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Unauthenticated SQL injection in the OrdaSoft Simple Membership extension for Joomla (versions before 7.4.0) allows any remote attacker to read and manipulate the site's backend database through crafted input to the checkLoginPass task. The site/simplemembership.php endpoint dispatches task=checkLoginPass with no authentication or access-control check and concatenates the login request parameter straight into a SQL query with no escaping or parameterization, which scores 9.3 under CVSS 4.0 with PR:N and no user interaction required. Exploitation needs only that the component be installed and enabled on a publicly reachable Joomla site - no credentials, user interaction, or non-default setting - and no public exploit identified at time of analysis.
Unauthenticated PHP object injection in the String Locator WordPress plugin (versions before 2.6.8) lets an attacker store a crafted serialized PHP object in a database row via the plugin's database editor, with no authentication required (PR:N per the assessed vector). The payload only fires when a site administrator subsequently opens and saves that row in the editor, which is the UI:R precondition, and it escalates to remote code execution, arbitrary file deletion, or sensitive data disclosure only if a suitable POP gadget chain exists in another installed plugin or component, which is why our independent assessment rates attack complexity as High (AC:H) despite the raw CVSS 8.8 vector using AC:L. Publicly available exploit code exists, but the two gating conditions (an admin save action plus a usable gadget chain) meaningfully reduce real-world exploitability, and no CISA KEV listing confirms active exploitation.
Authenticated users holding the WordPress Editor role on sites running the WP Coder plugin (versions 4.0 up to but not including 4.5.2) can save and execute arbitrary PHP code on the server, resulting in full site compromise. The flaw is a privilege-boundary failure: the plugin gates its PHP code-execution feature on a content capability that the Editor role holds by default rather than restricting it to administrators, so no plugin misconfiguration is needed. Exploitation requires an existing Editor-level (or higher) account - it is not remote-unauthenticated - but publicly available exploit code exists, and the vendor has released WP Coder 4.5.2 to fix it. No confirmed active exploitation (CISA KEV) has been reported, so risk is concentrated on sites that hand Editor access to semi-trusted contributors.
Stored cross-site scripting in Sachertortephp (MISP's CakePHP-derived framework) lets an authenticated user who can control an attachment filename inject CR/LF or a double quote into the Content-Disposition header generated by CakeResponse::download(). A CR/LF causes PHP to drop the entire Content-Disposition header so the response body renders inline with its own Content-Type on the application origin, while a double quote permits injection of additional Content-Disposition parameters; the payload is stored via attribute downloads, proposal downloads, or restSearch exports and executes when another authenticated user views the affected page. No public exploit code has been identified at time of analysis; an upstream fix is available via vendor commits.
Unauthenticated remote code execution in the SPIP Crayons plugin before 3.5.0 allows any remote attacker to take over a SPIP site by reaching crayons_store.php without the secu_ anti-forgery parameter, which causes the authorization dispatcher to select an unconditionally-true handler instead of the legitimate modification check. With authorization bypassed, the attacker can write an arbitrary .html skeleton file, read configuration files that expose the site secret, and forge a signed AJAX context that executes the planted skeleton as PHP under the web-server user. The assessed impact is high across confidentiality, integrity, and availability (CVSS:3.1 AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H; vendor-scored 9.3), exploitation requires only that the Crayons plugin be installed and enabled below 3.5.0, and no public exploit code was identified at time of analysis though the flaw is trivially reachable and unauthenticated.
HortusFox versions before 6.2 expose an authenticated remote code execution path through the theme import feature (ThemeModule::startImport): an uploaded ZIP archive is extracted into the public web root before file names, extensions, or content are validated, so an attacker with an administrator account can bundle a PHP payload and an .htaccess file that re-enables PHP execution and then execute arbitrary OS commands as the web-server user by requesting the dropped file under the themes directory. Exploitation is gated by administrator privileges (CVSS PR:H), so practical risk depends on obtaining or compromising an admin account; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). The vendor addressed the flaw in the 6.2 release, and the issue is tracked under CWE-434 (unrestricted upload of a file with a dangerous type).
Code injection in Microsoft Kiota 0.5.0 through pre-1.35.0 allows attacker-controlled text embedded in an OpenAPI description to break out of the generated Java or PHP documentation comment and execute in the consuming application or build environment once that generated source is compiled and loaded (Java) or loaded (PHP). The flaw is reachable unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) but requires user interaction: a developer or CI pipeline must generate client code from an untrusted or tampered spec and then build or load the output, making this a build-time/supply-chain path rather than an attack on already-deployed runtime services. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV; CVSS 3.1 base score is 8.8, and the issue is fixed in 1.35.0.
PHP code injection in the Smarty templating engine allows remote code execution in applications running Smarty 4.x before 4.5.8 or 5.x before 5.8.5 that render templates through the extends:/multi-component inheritance path with caching enabled. When such a template is compiled, the top-level unifunc never restores its nocache_hash, so the value is null; combined with an empty regex alternative in the cache-split logic, attacker-controlled assigned data containing a forged /*%%SmartyNocache:%%*/ marker is copied verbatim (bypassing PHP-tag neutralization) into the regenerated PHP cache file and executed on the next include. Exploitation is unauthenticated per the vendor CVSS vector (PR:N) but is gated by strict preconditions - inheritance-path templates, active caching, unescaped attacker-controlled output, and a fresh PHP process that reloads the compiled file after the cache entry is evicted (TTL expiry or cache clear) while compiled files persist - making it conditional rather than reliably on-demand; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis.
Insecure deserialization in the TrueLayer Magento 2 Plugin's Psr16CacheAdapter component allows an attacker who already has write access to the Magento cache backend (Redis or Memcached) to achieve arbitrary code execution via crafted PHP objects. The flaw arises from PHP's unserialize() being called without class restrictions, and exploitation requires both cache-write capability-obtainable through local filesystem access or an exposed cache service-and the presence of a usable gadget chain in the deployed Magento/Adobe Commerce environment. Although rated CVSS 7.5, real-world risk is materially lower because the attack preconditions are stringent; no public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited.
Authenticated remote code execution in Craft CMS 5.10.13.2 allows any low-privilege Control Panel user to run operating-system commands as the PHP/web-server process by injecting Twig through the app/render-components action. The attack requires only basic CP access; a non-admin Team user with no optional permissions was shown to override an EntryType uiLabelFormat and trigger an Entry render that evaluates attacker-controlled Twig via renderObjectTemplate(). No public exploit identified at time of analysis, but the impact is severe because the render path is unsandboxed and can reach PHP functions such as system().
Unauthenticated PHP object injection in the Haaken WordPress theme affects all versions up to and including 1.5, allowing remote attackers to supply crafted serialized data to an unserialize() sink without any prior authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1). The conditional nature of the risk is captured by the AC:H rating: full impact (remote code execution or data compromise) generally depends on a usable POP gadget chain being present in the theme, WordPress core, or another installed plugin, so exposure is limited to sites actually running this theme at an affected version. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and several vectors beyond the single Patchstack advisory reference (EUVD-2026-93080) remain unpublished.
Unauthenticated PHP Object Injection in the GDPR Framework By Data443 WordPress plugin through version 2.5.0 allows remote attackers to pass crafted serialized data to a PHP unserialize() path, potentially achieving full confidentiality, integrity, and availability impact if a usable gadget chain is reachable. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8) confirms network-reachable, low-complexity, unauthenticated exploitation with no user interaction; the only prerequisite is an active vulnerable plugin installation. No public exploit code or CISA KEV entry was identified at time of analysis, though reliable code execution depends on the presence of a gadget chain in the plugin, WordPress core, or other loaded components.
Unauthenticated SQL injection in the eLoanApp Platform's AJAX user-verification endpoint allows remote attackers to inject boolean- and time-based payloads into the POST parameter 'logina', enabling database engine discovery and query delays. The affected product is RDL Technologies eLoanApp Platform as represented by CPE cpe:2.3:a:rdl_technologies:eloanapp_platform:*:*:*:*:*:*:*:*, and the independent assessment scores this as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, meaning network-reachable, unauthenticated exploitation with low confidentiality, integrity, and availability impact rather than full compromise. No public exploit identified at time of analysis, and the practical risk is moderate because blind extraction is slow and noisy, making large-scale data theft time-consuming and more detectable than error-based injection.
Authenticated code execution via media upload in Kunstmaan CMS (KunstmaanBundlesCMS) before 7.3.2: the MediaBundle checks the file-extension blacklist case-sensitively but lowercases the extension before writing the file, so a backend user with media-upload rights can submit a file named e.g. webshell.pHp, slip past the blacklist, and have it stored as webshell.php inside the web-accessible media directory. Impact escalates to full remote code execution, but only where the web server is configured to execute scripts in public/uploads/media/ - the vendor's hardening guidance (disable script execution for that path, send X-Content-Type-Options: nosniff) removes the execution impact. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the flaw is gated behind a valid media-role account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.2).