Vulnerability feed

Executive summary

A deserialization flaw in the HotLock WordPress theme by ThemeREX Group affects versions up to and including 1.3.9. The advisory rates it as high priority with a CVSS score of 9.8 and says it is expected to be exploited, so it could let an unauthenticated attacker take control of affected websites. No official patch is stated as available, so the advisory recommends mitigating the issue immediately, such as with the Patchstack mitigation rule.

Technical summary

The vulnerability is a PHP Object Injection caused by deserialization of untrusted data, classified under OWASP A3: Injection. The advisory states that required privilege is unauthenticated, and that an attacker can manipulate how the site processes data to run harmful actions on the server. Affected versions are stated as from n/a through 1.3.9 and <= 1.3.9. No official patched version is stated; the advisory says no official patch is available. Patchstack has issued a mitigation rule to block attacks, and the advisory recommends updating the affected theme if possible, or asking a hosting provider or developer for help. No specific detection guidance, exploitation evidence beyond the expectation of exploitation, or other workarounds are stated in the advisory.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

ThemeREX GroupPatchstackThemeREX Group HotLock