Shinetheme Traveler WordPress Theme PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the Shinetheme Traveler WordPress theme, affecting versions prior to 3.2.8.1. This vulnerability could lead to PHP object injection, which, if exploited, might allow a malicious actor to execute code injection, SQL injection, path traversal, denial of service, and more, provided a suitable object injection chain is available.

Impact

Exploitation of this vulnerability could result in PHP object injection, allowing for various attacks such as code injection, SQL injection, path traversal, denial of service, and more, depending on the presence of a proper object injection chain.

Remediation

Users are advised to update the Shinetheme Traveler WordPress theme to version 3.2.8.1 or later. Patchstack has also issued a mitigation rule to block attacks until the update is applied.