Rexcoin
Monthly
Unauthenticated PHP object injection in the ThemeRex RexCoin WordPress theme at version 1.2.6 and earlier allows remote attackers to reach the theme's deserialization path without credentials and without user interaction, carrying a CVSS 3.1 score of 9.8 with high confidentiality, integrity and availability impact. Realized impact hinges on whether a usable gadget/POP chain is reachable in the theme or a co-installed plugin, a condition the available sources do not confirm, and the specific request, parameter or sink that triggers the injection is likewise not described. No public exploit code was identified at time of analysis, no fixed version is listed in the available data, and the vuln.today priority is act_now based largely on a single Patchstack source.
Unauthenticated PHP object injection in the ThemeRex RexCoin WordPress theme at version 1.2.6 and earlier allows remote attackers to reach the theme's deserialization path without credentials and without user interaction, carrying a CVSS 3.1 score of 9.8 with high confidentiality, integrity and availability impact. Realized impact hinges on whether a usable gadget/POP chain is reachable in the theme or a co-installed plugin, a condition the available sources do not confirm, and the specific request, parameter or sink that triggers the injection is likewise not described. No public exploit code was identified at time of analysis, no fixed version is listed in the available data, and the vuln.today priority is act_now based largely on a single Patchstack source.