Axiomthemes Sweet Dessert PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the Axiomthemes Sweet Dessert WordPress theme, affecting versions prior to 1.1.13. This vulnerability could lead to PHP object injection, with potential consequences such as code execution, SQL injection, path traversal, or denial of service, depending on the presence of a suitable object injection chain.

Impact

Exploitation of this vulnerability could allow for PHP object injection, with associated risks of code execution, SQL injection, path traversal, denial of service, and more, if a proper object injection chain is available.

Remediation

Users are advised to update to version 1.1.13 or later. Patchstack has also issued a virtual patch to block attacks targeting this vulnerability.