CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in axiomthemes Au Pair Agency - Babysitting & Nanny Theme au-pair-agency allows Object Injection.This issue affects Au Pair Agency - Babysitting & Nanny Theme: from n/a through <= 1.2.2.
Explanation of Vulnerability in Simple Terms
The Au Pair Agency theme versions 1.2.2 and earlier contain a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code on the site. The vulnerability requires high attack complexity but no user interaction. An attacker can exploit this by sending a specially crafted request to deserialize untrusted data, leading to remote code execution.
What an attacker can do
Run their own code on the site without authentication.
Potential impact on your site
An attacker can take full control of your site, access all data, modify content, and install malware.
Conditions required to exploit
Network access to the site; no authentication required, but the attack requires specific technical conditions.
Key dates
External resources
