Redy
Monthly
PHP object injection in the Axiomthemes Redy WordPress theme through version 1.3.5 lets unauthenticated remote attackers pass untrusted data into a deserialization path, rated 9.8 under the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Whether object instantiation converts into concrete impact such as file write, SQL injection or code execution depends on a usable POP gadget chain being present in the theme, WordPress core or an installed plugin; the specific vulnerable feature, parameter or configuration is not described in the available sources. Patchstack reported the issue and the CVE org record points to its advisory, while the priority decision is act_now; no KEV listing, no confirmed public exploit code and no EPSS value were supplied, and no fixed version is listed in the available evidence.
PHP object injection in the Axiomthemes Redy WordPress theme through version 1.3.5 lets unauthenticated remote attackers pass untrusted data into a deserialization path, rated 9.8 under the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N). Whether object instantiation converts into concrete impact such as file write, SQL injection or code execution depends on a usable POP gadget chain being present in the theme, WordPress core or an installed plugin; the specific vulnerable feature, parameter or configuration is not described in the available sources. Patchstack reported the issue and the CVE org record points to its advisory, while the priority decision is act_now; no KEV listing, no confirmed public exploit code and no EPSS value were supplied, and no fixed version is listed in the available evidence.