Travesia
Monthly
PHP object injection in the ThemeREX Travesia WordPress theme (versions up to and including 1.1.16) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to arbitrary code execution or other severe impacts if a usable POP gadget chain exists in the theme or other installed components. The vulnerability has a CVSS score of 9.8 and requires no authentication or user interaction. No public exploit code or active exploitation has been identified at time of analysis, and no vendor patch has been confirmed as available.
PHP object injection in the ThemeREX Travesia WordPress theme (versions up to and including 1.1.16) allows unauthenticated remote attackers to trigger deserialization of untrusted data, potentially leading to arbitrary code execution or other severe impacts if a usable POP gadget chain exists in the theme or other installed components. The vulnerability has a CVSS score of 9.8 and requires no authentication or user interaction. No public exploit code or active exploitation has been identified at time of analysis, and no vendor patch has been confirmed as available.