Mikado Themes Stål WordPress Theme Deserialization Vulnerability Allowing Object Injection

A deserialization vulnerability allowing object injection has been identified in the Mikado Themes Stål WordPress theme, affecting versions prior to 1.7. This vulnerability arises from the theme's improper handling of serialized data, which could be exploited to inject malicious objects.

Impact

Exploitation of this vulnerability could lead to PHP object injection, allowing for various attacks such as code execution, SQL injection, path traversal, or denial-of-service, depending on the presence of a suitable object injection chain.

Remediation

Users are advised to update the Mikado Themes Stål WordPress theme to version 1.7 or later. Patchstack has also issued a mitigation rule to block attacks until the update is applied.