White Rabbit
Monthly
PHP object injection in the axiomthemes White Rabbit WordPress theme through version 1.5.2 can allow remote attackers to pass crafted serialized data to a PHP unserialize() call, potentially causing object-injection side effects or code execution if a usable gadget chain exists. The vendor CVSS vector is 9.8 with PR:N/UI:N, suggesting unauthenticated remote exploitation, but our independent assessment raises attack complexity to High because successful code execution depends on a reachable POP chain in the theme, WordPress core, or an active plugin; no public exploit identified at time of analysis, no CISA KEV listing is present, and EPSS is low at 0.58% (46th percentile).
PHP object injection in the axiomthemes White Rabbit WordPress theme through version 1.5.2 can allow remote attackers to pass crafted serialized data to a PHP unserialize() call, potentially causing object-injection side effects or code execution if a usable gadget chain exists. The vendor CVSS vector is 9.8 with PR:N/UI:N, suggesting unauthenticated remote exploitation, but our independent assessment raises attack complexity to High because successful code execution depends on a reachable POP chain in the theme, WordPress core, or an active plugin; no public exploit identified at time of analysis, no CISA KEV listing is present, and EPSS is low at 0.58% (46th percentile).