Reprizo
Monthly
PHP object injection in the axiomthemes Reprizo WordPress theme, versions through 1.0.8, lets remote attackers supply serialized data that the theme passes to an unsafe deserialization call, potentially leading to object injection in the WordPress runtime. The vendor-assigned CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the priority decision is act_now given the network-reachable, pre-auth vector claimed by the score; only sites running this specific theme at 1.0.8 or earlier are in scope. No public exploit or proof-of-concept has been identified at time of analysis, the issue is not in CISA KEV, and realistic impact hinges on whether a usable POP gadget chain exists in the theme or an accompanying plugin, which the available sources do not confirm.
Unauthenticated local file inclusion in the Reprizo WordPress theme by AxiomThemes (versions 1.0.8 and earlier) allows remote attackers to coerce the PHP include/require chain into loading arbitrary server-side files, leading to disclosure of sensitive configuration data and potential code execution if uploaded or log files can be referenced. No public exploit identified at time of analysis, but the issue is tracked by Patchstack as a high-severity flaw against a commercial WordPress theme.
PHP object injection in the axiomthemes Reprizo WordPress theme, versions through 1.0.8, lets remote attackers supply serialized data that the theme passes to an unsafe deserialization call, potentially leading to object injection in the WordPress runtime. The vendor-assigned CVSS is 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), and the priority decision is act_now given the network-reachable, pre-auth vector claimed by the score; only sites running this specific theme at 1.0.8 or earlier are in scope. No public exploit or proof-of-concept has been identified at time of analysis, the issue is not in CISA KEV, and realistic impact hinges on whether a usable POP gadget chain exists in the theme or an accompanying plugin, which the available sources do not confirm.
Unauthenticated local file inclusion in the Reprizo WordPress theme by AxiomThemes (versions 1.0.8 and earlier) allows remote attackers to coerce the PHP include/require chain into loading arbitrary server-side files, leading to disclosure of sensitive configuration data and potential code execution if uploaded or log files can be referenced. No public exploit identified at time of analysis, but the issue is tracked by Patchstack as a high-severity flaw against a commercial WordPress theme.