Quirky
Monthly
Unauthenticated PHP object injection affects the ThemeRex Quirky WordPress theme through version 1.23, with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A remote attacker can reach the flaw without authentication, but the vulnerable parameter and endpoint are not identified in the available sources, and meaningful compromise depends on a usable POP gadget chain in the theme, WordPress core, or an installed plugin. No public exploit or confirmed active exploitation was identified at time of analysis, and the provided priority label is act_now.
Unauthenticated local file inclusion in the ThemeREX Quirky WordPress theme versions 1.23 and earlier allows remote attackers to include and disclose arbitrary local files on the server. The flaw stems from improper control of filename for include/require statements (CWE-98), which can escalate to remote code execution if attackers can plant or reach an includable PHP payload. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Unauthenticated PHP object injection affects the ThemeRex Quirky WordPress theme through version 1.23, with a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). A remote attacker can reach the flaw without authentication, but the vulnerable parameter and endpoint are not identified in the available sources, and meaningful compromise depends on a usable POP gadget chain in the theme, WordPress core, or an installed plugin. No public exploit or confirmed active exploitation was identified at time of analysis, and the provided priority label is act_now.
Unauthenticated local file inclusion in the ThemeREX Quirky WordPress theme versions 1.23 and earlier allows remote attackers to include and disclose arbitrary local files on the server. The flaw stems from improper control of filename for include/require statements (CWE-98), which can escalate to remote code execution if attackers can plant or reach an includable PHP payload. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.