CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio - Freelance Designer WordPress Theme allows Object Injection.This issue affects ColorFolio - Freelance Designer WordPress Theme: from n/a through 1.3.
Explanation of Vulnerability in Simple Terms
ColorFolio theme versions up to 1.3 contain a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code on the site. The vulnerability requires high attack complexity but no user interaction. An attacker can exploit this by sending a specially crafted request to deserialize untrusted data, leading to remote code execution with full site compromise.
What an attacker can do
Run arbitrary code on the site and take complete control of it.
Potential impact on your site
Complete site compromise including data theft, malware injection, and loss of availability.
Conditions required to exploit
Network access to the site; no authentication or user interaction required, but exploitation requires specific technical conditions.
Key dates
External resources
Related vulnerabilities
