Rhodos
Monthly
PHP object injection in the Axiomthemes Rhodos WordPress theme, affecting versions through 1.3.3, allows remote attackers to feed untrusted serialized data into a PHP unserialize() sink; the supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N with 9.8 severity, so no authentication or user interaction is required per those metrics. Beyond the injection itself, meaningful impact depends on whether a usable POP gadget chain is loadable in the theme or in co-installed plugins, which the available sources do not confirm; the trigger endpoint, parameter and configuration are not described in the available sources. No CISA KEV entry or confirmed public exploit is indicated at time of analysis, and the vuln.today decision label is act_now based on the Patchstack report.
PHP object injection in the Axiomthemes Rhodos WordPress theme, affecting versions through 1.3.3, allows remote attackers to feed untrusted serialized data into a PHP unserialize() sink; the supplied CVSS vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N with 9.8 severity, so no authentication or user interaction is required per those metrics. Beyond the injection itself, meaningful impact depends on whether a usable POP gadget chain is loadable in the theme or in co-installed plugins, which the available sources do not confirm; the trigger endpoint, parameter and configuration are not described in the available sources. No CISA KEV entry or confirmed public exploit is indicated at time of analysis, and the vuln.today decision label is act_now based on the Patchstack report.