Veto
Monthly
PHP object injection in the Axiomthemes Veto WordPress theme (all versions through 1.6.0) lets remote attackers hand untrusted serialized data to PHP's unserialize(), which can instantiate arbitrary classes if a usable gadget chain is reachable. The attack is network-reachable against a default theme install and, per the assessed vector (PR:N/UI:N), requires neither authentication nor user interaction, though the assessed attack complexity is High (AC:H) because exploitation depends on a POP chain being present in the theme, an installed plugin, or WordPress core. Practical impact is therefore conditional: the 9.8-style severity reflects worst-case object injection outcomes rather than a guaranteed code-execution path, and no public exploit has been identified at time of analysis. Note the affected product is a niche commercial theme, and no fixed version is stated in the available data.
PHP object injection in the Axiomthemes Veto WordPress theme (all versions through 1.6.0) lets remote attackers hand untrusted serialized data to PHP's unserialize(), which can instantiate arbitrary classes if a usable gadget chain is reachable. The attack is network-reachable against a default theme install and, per the assessed vector (PR:N/UI:N), requires neither authentication nor user interaction, though the assessed attack complexity is High (AC:H) because exploitation depends on a POP chain being present in the theme, an installed plugin, or WordPress core. Practical impact is therefore conditional: the 9.8-style severity reflects worst-case object injection outcomes rather than a guaranteed code-execution path, and no public exploit has been identified at time of analysis. Note the affected product is a niche commercial theme, and no fixed version is stated in the available data.