The ZenSoul WordPress theme from ThemeREX, versions up to and including 1.13, deserializes untrusted data without proper validation. An unauthenticated remote attacker can inject PHP objects, which may allow manipulation of server-side processing and, depending on other code loaded on the site, harmful actions on the server. Patchstack rates the issue as high priority with CVSS 9.8, but no official patch is confirmed.
ThemeREX · ZenSoul
The Save Life WordPress theme by ThemeREX up to and including version 1.2.14 deserializes untrusted data, which allows PHP object injection. An unauthenticated remote attacker can manipulate how the website processes data and may run harmful actions on the server, with a CVSS score of 9.8. No vendor patch is available, and no confirmed exploitation or public proof of concept was found at the time of writing.
ThemeREX · Save Life
The Buzz Stone | Magazine & Viral Blog WordPress theme in versions 1.0.2 and earlier contains an unauthenticated PHP Object Injection flass (CWE-502). An attacker can send crafted serialized data to the site without logging in, which may allow manipulation of server-side processing and, depending on the code and plugins present, remote code execution. Patchstack rates this as high priority and expects exploitation, but no exploitation is confirmed in the sources reviewed.
ThemeRex · Buzz Stone | Magazine & Viral Blog WordPress Theme
The Photolia WordPress theme up to and including version 1.0.3 contains a PHP object injection flaw (CWE-502) that can be triggered without logging in. An attacker can send crafted serialized data to the website, which can lead to harmful actions on the server. The full impact depends on the other components installed on the site, and no fixed version has been confirmed by the vendor.
ThemeREX · Photolia
The WordPress theme Jacqueline up to and including version 2.22 contains a PHP Object Injection flaw (CWE-502, deserialization of untrusted data). An unauthenticated remote attacker can submit crafted data that the theme unserializes, which may allow manipulation of server-side processing and harmful actions on the web server. Patchstack and CISA SSVC data rate the impact as total, and the CVSS score is 9.8.
ThemeREX · Jacqueline
The ThemeREX Alliance WordPress theme up to and including version 3.11 contains a PHP object injection vulnerability (CWE-502). An unauthenticated remote attacker can send crafted data that the site unserializes, which can manipulate application logic and, depending on the code available in the installed components, lead to code execution on the server. The CVSS 3.1 base score is 9.8 (critical). Internet-facing and extranet sites running this theme are most at risk.
ThemeREX · Alliance
The WordPress theme ShiftCV by ThemeREX, versions up to and including 3.0.14, contains a PHP Object Injection flaw (CWE-502) in the handling of serialized data. The flaw can be triggered without authentication over the network, so an attacker could manipulate how the site processes data. Patchstack and CISA SSVC rate the impact as total, and code execution is plausible depending on the installed code, but this is not confirmed.
ThemeREX · ShiftCV
The ThemeREX Windsor WordPress theme in versions up to and including 2.10 contains an unauthenticated PHP Object Injection flaw (CWE-502). An attacker can send crafted data to the site without logging in, which can manipulate how the application processes objects on the server. Depending on other code installed on the site, this may lead to file deletion, disclosure of sensitive data or code execution. The CVSS score is 9.8 (critical).
ThemeREX · Windsor
The WordPress theme Education Center up to and including version 3.6.12 contains an unauthenticated PHP Object Injection flaw (CWE-502). An attacker can send crafted serialized data to the site without logging in, which may allow manipulation of server-side processing and, depending on other installed components, code execution or data compromise. Any site with the theme active and reachable from the internet is exposed.
ThemeREX · Education Center
The WordPress theme Asia Garden in versions up to and including 1.3.1 contains an unauthenticated PHP object injection flaw (CWE-502), rated CVSS 9.8 (critical). A remote attacker can send crafted data to the website without logging in, which can cause the server to process harmful objects. Whether this leads to code execution depends on the other PHP software on the site that can be abused as a gadget chain, which is unknown.
ThemeREX · Asia Garden
The N7 | Golf Club Sports & Events WordPress theme up to and including version 2.21 contains an unauthenticated PHP object injection flaw (CWE-502). An attacker can send crafted serialized data to the site without logging in, which may allow manipulation of server-side processing and, depending on the available PHP classes, code execution. The CVSS score is 9.8 (critical), and Patchstack expects exploitation.
ThemeREX · N7 | Golf Club Sports & Events
The Invetex WordPress theme by ThemeREX up to and including version 2.18 contains an unauthenticated PHP Object Injection flaw (CWE-502). A remote attacker without an account can send crafted input to the website, which may lead to arbitrary code execution on the server and full compromise of confidentiality, integrity and availability. Exploitation depends on gadget chains available in the site's code, which the sources do not address.
ThemeREX · Invetex
The Law Office WordPress theme by ThemeREX, versions up to and including 3.20, contains an unauthenticated PHP object injection flaw (CWE-502). An attacker can send crafted data over the network without logging in, which can manipulate how the website processes data. The CVSS vector rates confidentiality, integrity and availability impact as high, and code execution depends on gadget chains present in the installation, which are not verified.
ThemeREX · Law Office
The WineShop WordPress theme up to and including version 3.20 contains an unauthenticated PHP Object Injection flaw (CWE-502). An remote attacker can send crafted serialized data to the website without logging in or any user interaction. Patchstack rates it as high priority and CISA SSVC lists it as automatable with total technical impact; exploitation in the wild is not confirmed. Whether code execution is actually reachable depends on the PHP classes present in the installed code and plugins.
ThemeREX · WineShop
The Equadio WordPress theme up to and including version 1.1.4 contains an unauthenticated PHP Object Injection vulnerability (CWE-502). An attacker on the internet can send crafted input to a vulnerable site, which may lead to code execution, data theft or site disruption, depending on the PHP classes available on the server. The CVSS score of 9.8 was assigned by the CNA Patchstack; NVD has not yet analysed the entry, and no known exploitation or public proof of concept has been confirmed.
ThemeREX · Equadio WordPress theme
The Juno WordPress theme by ThemeREX, version 2.25 and earlier, contains an unauthenticated PHP Object Injection flaw (CWE-502) that is rated CRITICAL with CVSS 9.8. An attacker can send crafted serialized data to the website without logging in, which may allow manipulation of server-side processing and, depending on the classes available in the site's code, remote code execution. No official fixed version has been confirmed by the vendor, and sources disagree on the first fixed release. Juno is aimed at WooCommerce shops, which are often internet-facing.
ThemeREX · Juno WordPress theme
The Yacht Rental WordPress theme by ThemeREX up to and including version 2.6 contains an unauthenticated PHP Object Injection flaw (CWE-502) that can be triggered over the network without a login. A successful attacker could manipulate how the website processes serialized data, which may allow harmful actions on the server, depending on the gadget chains available in the installed plugins and libraries. The CNA rates the issue CVSS 9.8 (critical), and Patchstack classifies it as high priority.
ThemeREX · Yacht Rental
The WordPress theme Wine House up to and including version 3.20 contains an unauthenticated PHP Object Injection vulnerability (CVSS 9.8, critical). An attacker can send crafted data so that the website processes it as PHP objects, which can lead to harmful actions on the server. Public WordPress sites running this theme are exposed by default, and the vendor and aggregator sources report the impact as possible arbitrary code execution, which is not independently verified.
ThemeREX · Wine House
The Tipsy WordPress theme up to version 1.6 contains a PHP object injection flaw that can be triggered without authentication over HTTP. An attacker who sends crafted input to the website may be able to manipulate how data is processed on the server, which could lead to code execution or data manipulation depending on the PHP classes present on the site. The CVSS score is 9.8 (Critical), and Patchstack expects the flaw to be used in mass-exploit campaigns.
ThemeREX · Tipsy
The WordPress theme Stargaze up to and including version 1.10 is vulnerable to PHP Object Injection (CWE-502) without authentication. An unauthenticated remote attacker may be able to manipulate how the site processes serialized data, which could lead to harmful actions on the server. The CVSS score is 9.8 (critical). No confirmed exploitation or public proof of concept is known.
ThemeREX · Stargaze
The WordPress theme Splendour in versions 1.23 and earlier contains an unauthenticated PHP Object Injection flaw (CWE-502). An attacker can send a crafted serialized PHP payload that the theme unserializes, which may allow manipulation of server-side processing and, depending on available gadget chains, arbitrary code execution. No login is required, so any internet-facing WordPress site with this theme installed is at risk.
ThemeREX · Splendour
