WordPress Noisa Theme PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the WordPress Noisa theme, affecting versions through 2.6.0. This vulnerability could lead to various injection attacks, including code injection, SQL injection, and path traversal, especially if a suitable property-oriented programming (POP) chain is available.

Impact

Exploitation of this vulnerability allows for PHP object injection, which could be leveraged to execute code, inject SQL, traverse paths, or cause a denial-of-service, depending on the presence of a proper POP chain.

Remediation

Users are advised to update to version 2.6.2 or later. Patchstack has also issued a virtual patch to block attacks until the update is applied.