Preservation
Monthly
Unauthenticated PHP object injection in the ThemeREX Preservation WordPress theme through version 1.15 can let remote attackers supply serialized input that the theme deserializes, with a CVSS 9.8 rating reflecting potential high confidentiality, integrity, and availability impact. Exploitation requires a WordPress site running the affected theme, and while the vector shows no authentication or user interaction, the available sources do not confirm a usable gadget chain or identify the vulnerable endpoint and parameter. No public exploit was identified at time of analysis, but the act_now priority and severe rating warrant prompt verification against the Patchstack advisory.
Unauthenticated local file inclusion in the ThemeREX Preservation WordPress theme versions 1.10 and earlier allows remote attackers to read arbitrary files from the underlying web server, with high complexity (AC:H) but no authentication required (PR:N). The flaw, reported by Patchstack and classified as CWE-98 (improper filename control for PHP include/require statements), can lead to disclosure of sensitive files such as wp-config.php and, depending on the inclusion path, potentially full code execution. No public exploit identified at time of analysis and no KEV listing.
Unauthenticated PHP object injection in the ThemeREX Preservation WordPress theme through version 1.15 can let remote attackers supply serialized input that the theme deserializes, with a CVSS 9.8 rating reflecting potential high confidentiality, integrity, and availability impact. Exploitation requires a WordPress site running the affected theme, and while the vector shows no authentication or user interaction, the available sources do not confirm a usable gadget chain or identify the vulnerable endpoint and parameter. No public exploit was identified at time of analysis, but the act_now priority and severe rating warrant prompt verification against the Patchstack advisory.
Unauthenticated local file inclusion in the ThemeREX Preservation WordPress theme versions 1.10 and earlier allows remote attackers to read arbitrary files from the underlying web server, with high complexity (AC:H) but no authentication required (PR:N). The flaw, reported by Patchstack and classified as CWE-98 (improper filename control for PHP include/require statements), can lead to disclosure of sensitive files such as wp-config.php and, depending on the inclusion path, potentially full code execution. No public exploit identified at time of analysis and no KEV listing.