Rosalinda
Monthly
Unauthenticated PHP object injection in the ThemeREX Group Rosalinda WordPress theme, affecting all versions through 1.2.4, lets remote attackers reach an unserialize() sink and inject arbitrary PHP objects. The reported CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), though independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because meaningful exploitation additionally requires a usable POP gadget chain in the theme, WordPress core, or an installed plugin; the deserialization primitive alone is inert without one. The CVSS vector confirms no authentication or user interaction is needed to reach the sink, and while the advisory does not name the specific endpoint or parameter, no public exploit code has been identified at time of analysis.
Local file inclusion in the Rosalinda WordPress theme ≤1.2.3 permits unauthenticated attackers to arbitrarily include local files, leading to information disclosure and potential remote code execution. The vulnerability is rated high severity (CVSS 8.1) but has low exploitation likelihood (EPSS 0.08%), and there is no evidence of active exploitation or public exploit code at this time.
Unauthenticated PHP object injection in the ThemeREX Group Rosalinda WordPress theme, affecting all versions through 1.2.4, lets remote attackers reach an unserialize() sink and inject arbitrary PHP objects. The reported CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), though independent assessment raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because meaningful exploitation additionally requires a usable POP gadget chain in the theme, WordPress core, or an installed plugin; the deserialization primitive alone is inert without one. The CVSS vector confirms no authentication or user interaction is needed to reach the sink, and while the advisory does not name the specific endpoint or parameter, no public exploit code has been identified at time of analysis.
Local file inclusion in the Rosalinda WordPress theme ≤1.2.3 permits unauthenticated attackers to arbitrarily include local files, leading to information disclosure and potential remote code execution. The vulnerability is rated high severity (CVSS 8.1) but has low exploitation likelihood (EPSS 0.08%), and there is no evidence of active exploitation or public exploit code at this time.