Royal Event
Monthly
PHP object injection in the ThemeREX Royal Event WordPress theme affects versions up to and including 2.0: attacker-supplied serialized data reaching an unserialize() call can instantiate arbitrary objects. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity and availability impact, and the vuln.today decision label is act_now. No public exploit code or CISA KEV entry is reported in the available data, and the actual impact hinges on whether a usable POP gadget chain exists in the theme, WordPress core or an installed plugin; the specific triggering endpoint and parameter are not described in the available sources.
PHP object injection in the ThemeREX Royal Event WordPress theme affects versions up to and including 2.0: attacker-supplied serialized data reaching an unserialize() call can instantiate arbitrary objects. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8) describes a network-reachable, low-complexity, unauthenticated flaw with full confidentiality, integrity and availability impact, and the vuln.today decision label is act_now. No public exploit code or CISA KEV entry is reported in the available data, and the actual impact hinges on whether a usable POP gadget chain exists in the theme, WordPress core or an installed plugin; the specific triggering endpoint and parameter are not described in the available sources.