Exertio WordPress Theme PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the Exertio WordPress theme, affecting versions through 1.3.2. This vulnerability could lead to PHP object injection, which, if exploited, might allow a malicious actor to execute code injection, SQL injection, path traversal, denial of service, and more, depending on the presence of a suitable property-oriented programming chain.

Impact

Exploitation of this vulnerability could result in PHP object injection, allowing for various types of code injection, SQL injection, path traversal, denial of service, and potentially more, depending on the presence of a proper property-oriented programming chain.

Remediation

Users are advised to update to version 1.3.3 or later. Patchstack has issued a virtual patch to block attacks until the update is applied.