WordPress Gracey Theme Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the WordPress Gracey theme, affecting versions prior to 1.4. This vulnerability arises from the improper handling of untrusted data, which could potentially be exploited to execute arbitrary code or other malicious actions, depending on the presence of a suitable object injection chain.

Impact

Exploitation of this vulnerability could lead to PHP object injection, allowing for arbitrary code execution, SQL injection, path traversal, denial-of-service, and more, if a proper object injection chain is established.

Remediation

Users are advised to update the WordPress Gracey theme to version 1.4 or later. Patchstack has also issued a mitigation rule to block attacks targeting this vulnerability.