Designthemes Visual Art Gallery WordPress Theme PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the Designthemes Visual Art | Gallery WordPress Theme, affecting versions through 2.4. This vulnerability arises from the theme's improper handling of untrusted data, which could potentially be exploited to inject malicious objects.

Impact

Exploitation of this vulnerability could lead to PHP object injection, allowing for various types of code injection, such as SQL injection, path traversal, or denial-of-service, especially if a suitable property-oriented programming chain is available.

Remediation

Users are advised to update to a version later than 2.4. Patchstack has issued a virtual patch to block attacks targeting this vulnerability until an official fix is available.