WordPress Education Center Theme PHP Object Injection Vulnerability

A PHP Object Injection vulnerability has been identified in the Education Center theme for WordPress, affecting all versions up to and including 3.6.10. The vulnerability arises from the deserialization of untrusted input in the 'themerex_callback_view_more_posts' function, allowing unauthenticated attackers to inject a PHP object. While no known Payload Object Injection (POP) chain exists within the vulnerable theme, the vulnerability could be exploited if another plugin or theme with a POP chain is installed, potentially enabling actions such as deleting arbitrary files, retrieving sensitive data, or executing code, depending on the specific POP chain available.

Impact

Exploitation of this vulnerability could lead to PHP Object Injection, allowing attackers to inject objects that could be manipulated if a suitable POP chain is present through another plugin or theme.

Remediation

Users are advised to update the Education Center theme to version 3.6.11 or a newer patched version.