The Mission WordPress theme up to version 1.22 contains an unauthenticated PHP Object Injection flaw (CWE-502). An attacker can send crafted data that the application unserializes, which can manipulate application logic and, depending on gadget chains available on the server, lead to code execution. Patchstack rates it CVSS 9.8 and high priority. Public websites are reachable from the internet by design, so exposure is high.
ThemeREX · Mission
The Meals & Wheels WordPress theme up to and including version 1.1.13 contains a PHP Object Injection weakness (CWE-502). An unauthenticated remote attacker can submit crafted serialized data, which may allow manipulation of how the site processes data and execution of harmful actions on the server. The CVSS score of 9.8 is a CNA score, as NVD enrichment is pending.
ThemeREX · Meals & Wheels
The Marcell WordPress theme up to and including version 1.2.14 is affected by an unauthenticated PHP Object Injection flaw (CWE-502). An unauthenticated remote attacker can send crafted data to the site, which may let them manipulate how the site processes data and potentially run harmful actions on the server. NVD rates the issue 9.8 (Critical), while VulDB rates it 7.3. No vendor patch has been confirmed, and no public exploit or known in-the-wild use was found.
ThemeREX · Marcell
The WordPress theme Le Truffe up to and including version 1.1.7 contains an unauthenticated PHP Object Injection flaw (CWE-502). An unauthenticated remote attacker can send crafted serialized data to the site, which may lead to code execution, file manipulation or denial of service, depending on the code available on the server. The CVSS base score is 9.8 (critical), and Patchstack expects mass exploitation.
ThemeREX · Le Truffe
The Legal Stone WordPress theme up to and including version 1.2.11 contains an unauthenticated PHP object injection vulnerability (CWE-502). An unauthenticated remote attacker can manipulate serialized data processed by the website, which may allow execution of harmful actions on the server. Patchstack rates the issue as critical (CVSS 9.8) and expects exploitation, but no fixed version or public exploit has been confirmed.
ThemeREX · Legal Stone
The WordPress plugin MLS On The Fly up to and including version 1.8.1.5 contains an SQL injection flaw (CWE-89). An authenticated user with the low-privilege Subscriber role can send crafted input that is passed unsanitised to the database. A successful attack could read, modify or delete database content, including user accounts and stored customer or lead data. Patchstack reports that no official patch is available yet, and the vendor attribution is unconfirmed.
Realtyna · MLS On The Fly
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The WordPress plugin GEO my WordPress up to and including version 4.5.5.3 contains a PHP Object Injection vulnerability (CWE-502) in which untrusted data is deserialized. An unauthenticated remote attacker can exploit it over the network without a login, which may allow manipulation of server-side processing and potentially harmful actions on the web server. Successful exploitation depends on the installed plugins and libraries, which could not be verified.
Eyal Fitoussi · GEO my WordPress
The Cache add-on for the WordPress plugin Ajax Load More, in versions 3.1.1 and earlier, contains an unauthenticated remote code execution flaw (CWE-94, code injection). An attacker on the internet can send crafted requests without a login and, according to the Patchstack classification, run arbitrary commands on the server. Exposure depends on whether the add-on is installed on an internet-facing WordPress site.
Connekthq · Ajax Load More Cache
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The Ozisti WordPress theme up to and including version 1.1.10 contains an unauthenticated PHP Object Injection vulnerability (CWE-502). An attacker can send crafted serialized data to the site, which can manipulate how the application processes data and potentially run harmful actions on the server. No login is required, and the NVD rates the issue as critical (CVSS 3.1 9.8), although other scoring sources differ.
ThemeREX · Ozisti
The Preservation WordPress theme up to and including version 1.15 contains an unauthenticated PHP object injection flaw (CWE-502). An unauthenticated remote attacker can supply crafted serialized data that the theme processes, which can manipulate application logic and may lead to further actions on the server. Whether code execution is possible depends on gadget chains available in other installed plugins or themes, which is not confirmed for this theme. The NVD score is 9.8 (Critical), but the NVD record is still in Deferred status.
ThemeREX · Preservation
The WordPress theme Printy up to and including version 1.13.0 contains a PHP Object Injection flaw (CWE-502) that can be triggered without authentication over the network. An attacker can manipulate serialized data processed by the site, which may lead to harmful actions on the server, depending on the installed plugins and code available for chaining. The vulnerability is rated critical with CVSS 9.8, and Patchstack expects exploitation in mass campaigns, although no exploitation has been confirmed so far.
ThemeREX · Printy
The Quirky WordPress theme in versions up to and including 1.23 contains a PHP Object Injection vulnerability (CWE-502). An unauthenticated remote attacker can send crafted serialized data to a public site, which may allow manipulation of server-side processing and, depending on the PHP classes available on the site, code execution or other serious impact. The CVSS base score is 9.8 (critical); the actual impact per site could not be verified.
ThemeREX · Quirky WordPress theme
The RexCoin WordPress theme up to and including version 1.2.6 contains an unauthenticated PHP object injection flaw (CWE-502). A remote attacker can send crafted data to a public website without logging in, which can let them manipulate server-side processing and potentially run harmful code. Patchstack rates the issue as high priority with a CVSS score of 9.8 and expects it to be exploited, while NVD status is currently Deferred.
ThemeREX · RexCoin WordPress theme
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
