Save Life
Monthly
PHP object injection in the ThemeREX Save Life WordPress theme through version 1.2.14 lets remote attackers route crafted serialized data into an unsafe unserialize() path, scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with high confidentiality, integrity and availability impact. The specific feature, parameter or endpoint that reaches the deserialization sink is not described in the available sources, and a usable POP gadget chain in the theme, an installed plugin or WordPress core is unconfirmed, so realized impact may be narrower than the score implies. No CISA KEV entry or public exploit code is associated with this CVE in the supplied intelligence, although the vuln.today decision label is act_now.
PHP object injection in the ThemeREX Save Life WordPress theme through version 1.2.14 lets remote attackers route crafted serialized data into an unsafe unserialize() path, scored 9.8 under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H with high confidentiality, integrity and availability impact. The specific feature, parameter or endpoint that reaches the deserialization sink is not described in the available sources, and a usable POP gadget chain in the theme, an installed plugin or WordPress core is unconfirmed, so realized impact may be narrower than the score implies. No CISA KEV entry or public exploit code is associated with this CVE in the supplied intelligence, although the vuln.today decision label is act_now.