Smart Casa
Monthly
PHP object injection in the ThemeREX Group Smart Casa WordPress theme, affecting all versions up to and including 1.0.12, lets remote attackers supply crafted serialized input to an unserialize() call without authentication (CVSS PR:N/UI:N), with the vendor/Patchstack score reaching 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Meaningful impact - remote code execution, arbitrary file write, or SQL injection - depends on a usable POP gadget chain being reachable in the theme, WordPress core, or an installed plugin, which is why our independent assessment rates the vector at AC:H despite the 9.8 base score; sites running only the theme, or with a reduced plugin set, may be far less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but Patchstack's database entry (https://patchstack.com/database/wordpress/theme/smart-casa/vulnerability/wordpress-smart-casa-theme-1-0-12-php-object-injection-vulnerability?_s_id=cve) makes the flaw publicly documented and easily locatable by attackers.
PHP object injection in the ThemeREX Group Smart Casa WordPress theme, affecting all versions up to and including 1.0.12, lets remote attackers supply crafted serialized input to an unserialize() call without authentication (CVSS PR:N/UI:N), with the vendor/Patchstack score reaching 9.8 (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H). Meaningful impact - remote code execution, arbitrary file write, or SQL injection - depends on a usable POP gadget chain being reachable in the theme, WordPress core, or an installed plugin, which is why our independent assessment rates the vector at AC:H despite the 9.8 base score; sites running only the theme, or with a reduced plugin set, may be far less exposed. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but Patchstack's database entry (https://patchstack.com/database/wordpress/theme/smart-casa/vulnerability/wordpress-smart-casa-theme-1-0-12-php-object-injection-vulnerability?_s_id=cve) makes the flaw publicly documented and easily locatable by attackers.