Select-Themes Borgholm WordPress Theme PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the Select-Themes Borgholm marketing agency WordPress theme, affecting versions prior to 1.6. This vulnerability arises from the theme's improper handling of untrusted data, which could be exploited to inject malicious objects.

Impact

Exploitation of this vulnerability could lead to PHP object injection, allowing for various attacks such as code execution, SQL injection, path traversal, or denial-of-service, depending on the presence of a suitable object injection chain.

Remediation

Users are advised to update the theme to version 1.6 or later. Patchstack has also provided a mitigation rule to block attacks targeting this vulnerability until the update is applied.