LoftOcean CozyStay WordPress Theme PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the LoftOcean CozyStay WordPress theme, affecting versions prior to 1.7.1. This vulnerability could lead to various injection attacks, including code injection and SQL injection, especially if a suitable object injection chain is available.

Impact

Exploitation of this vulnerability could allow for PHP object injection, which may lead to code execution, SQL injection, path traversal, denial-of-service, and other impacts, depending on the presence of a proper object injection chain.

Remediation

Users are advised to update the CozyStay WordPress theme to version 1.7.1 or later. Patchstack has also issued a virtual patch to block attacks targeting this vulnerability.