Stargaze
Monthly
Unauthenticated PHP object injection in the Stargaze WordPress theme (versions 1.10 and earlier) allows remote attackers to submit a crafted serialized payload that the theme feeds to PHP's unserialize(), which can trigger arbitrary object instantiation and, where a usable gadget chain is present, code execution or full site compromise; the maximum-base CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact. Per that vector no authentication (PR:N) and no user interaction (UI:N) are required, and the CPE record cpe:2.3:a:themerex:stargaze ties the exposure to the ThemeREX Stargaze theme, so only sites with this theme installed and active are in scope. At time of analysis there is no public exploit identified, and the practical ceiling on impact depends on whether a viable POP gadget chain exists in the theme itself, a co-installed plugin, or WordPress core.
Unauthenticated PHP object injection in the Stargaze WordPress theme (versions 1.10 and earlier) allows remote attackers to submit a crafted serialized payload that the theme feeds to PHP's unserialize(), which can trigger arbitrary object instantiation and, where a usable gadget chain is present, code execution or full site compromise; the maximum-base CVSS 3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects high confidentiality, integrity, and availability impact. Per that vector no authentication (PR:N) and no user interaction (UI:N) are required, and the CPE record cpe:2.3:a:themerex:stargaze ties the exposure to the ThemeREX Stargaze theme, so only sites with this theme installed and active are in scope. At time of analysis there is no public exploit identified, and the practical ceiling on impact depends on whether a viable POP gadget chain exists in the theme itself, a co-installed plugin, or WordPress core.