CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme.This issue affects Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme: from n/a through 8.4.1.
Explanation of Vulnerability in Simple Terms
The Soledad WordPress theme versions up to 8.4.1 contain a deserialization vulnerability in how it processes untrusted data. An attacker can craft malicious serialized PHP objects that, when deserialized by the theme, execute arbitrary code on the site. This requires network access but no authentication or user interaction.
What an attacker can do
Run arbitrary PHP code on the site and take full control of it.
Potential impact on your site
Complete site compromise: attacker can modify content, steal data, install malware, or deface the site.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
