Elated Themes Leroux WordPress Theme Deserialization Vulnerability Allowing Object Injection

A deserialization vulnerability allowing object injection has been identified in the Elated Themes Leroux WordPress theme, affecting versions prior to 1.4. This vulnerability arises from the theme's improper handling of untrusted data, which could be exploited to inject malicious objects.

Impact

Exploitation of this vulnerability could lead to PHP object injection, allowing for various attacks such as code execution, SQL injection, path traversal, or denial-of-service, depending on the presence of a suitable object injection chain.

Remediation

Users are advised to update the Leroux WordPress theme to version 1.4 or later. Patchstack has also issued a mitigation rule to block attacks targeting this vulnerability.