Printy
Monthly
Unauthenticated PHP object injection in the Printy WordPress theme through version 1.13.0 lets remote attackers supply serialized data to a PHP deserialization point without credentials or user interaction, carrying a CVSS 9.8 rating and an act_now priority. The supplied intelligence does not identify active exploitation (no CISA KEV entry) or public exploit code, and real-world impact depends on whether a usable POP gadget chain exists in Printy or a co-installed plugin because the vulnerable parameter and trigger are not described. Sites running Printy 1.13.0 or earlier should be treated as exposed until a fixed release is confirmed.
Unauthenticated PHP object injection in the Printy WordPress theme through version 1.13.0 lets remote attackers supply serialized data to a PHP deserialization point without credentials or user interaction, carrying a CVSS 9.8 rating and an act_now priority. The supplied intelligence does not identify active exploitation (no CISA KEV entry) or public exploit code, and real-world impact depends on whether a usable POP gadget chain exists in Printy or a co-installed plugin because the vulnerable parameter and trigger are not described. Sites running Printy 1.13.0 or earlier should be treated as exposed until a fixed release is confirmed.