Vulnerability feed

Executive summary

A deserialization flaw in the ZenSoul WordPress theme, made by ThemeREX, lets outside attackers inject objects into the site. The advisory rates it 9.8 on CVSS and says it is expected to be exploited in mass attack campaigns. The recommended action is to update the theme, but the advisory states no official patch is available, so it suggests using a mitigation rule or asking a hosting provider or developer for help.

Technical summary

The flaw is a PHP Object Injection caused by deserialization of untrusted data, and the advisory states it requires no authentication (required privilege: Unauthenticated). The vulnerable versions are listed as from n/a through 1.13 and as less than or equal to 1.13. No fixed version is stated, and the advisory says no official patch is available. Patchstack has issued a mitigation rule that blocks attacks until an official patch can be tested and applied. The advisory does not state a specific workaround beyond that mitigation rule, and it gives no detection guidance or indicators of compromise.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from patchstack.com/database/wordpress/theme…nerability?_s_id=cve

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

ThemeRexThemeRex ZenSoul