Vagabonds
Monthly
PHP object injection in the ThemeREX 'Vagabonds' WordPress theme (all versions through 1.3.10) lets remote unauthenticated attackers pass untrusted serialized data into PHP's unserialize() path, carrying a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and full High confidentiality, integrity and availability impact per the assessed vector. The concrete endpoint or parameter that feeds attacker data into the unserializer is not described in the available sources, and real-world impact - code execution, file read/write, or denial of service - depends on a usable POP gadget chain being reachable in the theme, an installed plugin, or WordPress core, which is not confirmed in the data. Exploitation presupposes the Vagabonds theme is installed and active at version 1.3.10 or below; no public exploit code has been identified at time of analysis, and the issue carries an act_now priority label from the reporting intelligence.
PHP object injection in the ThemeREX 'Vagabonds' WordPress theme (all versions through 1.3.10) lets remote unauthenticated attackers pass untrusted serialized data into PHP's unserialize() path, carrying a CVSS 3.1 score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and full High confidentiality, integrity and availability impact per the assessed vector. The concrete endpoint or parameter that feeds attacker data into the unserializer is not described in the available sources, and real-world impact - code execution, file read/write, or denial of service - depends on a usable POP gadget chain being reachable in the theme, an installed plugin, or WordPress core, which is not confirmed in the data. Exploitation presupposes the Vagabonds theme is installed and active at version 1.3.10 or below; no public exploit code has been identified at time of analysis, and the issue carries an act_now priority label from the reporting intelligence.