Qwery
Monthly
Unauthenticated PHP object injection in the Qwery WordPress theme (versions 3.6.1 and earlier) allows any remote attacker who can reach an affected site to pass crafted serialized data into a PHP deserialization sink, with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, rated 9.8). Because the flaw is CWE-502, real-world impact depends on whether an exploitable PHP gadget chain exists in WordPress core, the theme, or any installed plugin; if such a chain is reachable, the issue can escalate to remote code execution, arbitrary file write, or SQL injection, otherwise impact may be reduced. At the time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, though the unauthenticated network vector and full C/I/A rating make the theme a high-priority item for any internet-facing WordPress installation running it.
Unauthenticated PHP object injection in the Qwery WordPress theme (versions 3.6.1 and earlier) allows any remote attacker who can reach an affected site to pass crafted serialized data into a PHP deserialization sink, with no authentication or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, rated 9.8). Because the flaw is CWE-502, real-world impact depends on whether an exploitable PHP gadget chain exists in WordPress core, the theme, or any installed plugin; if such a chain is reachable, the issue can escalate to remote code execution, arbitrary file write, or SQL injection, otherwise impact may be reduced. At the time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified, though the unauthenticated network vector and full C/I/A rating make the theme a high-priority item for any internet-facing WordPress installation running it.