Edge-Themes Pelicula WordPress Theme PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the Edge-Themes Pelicula WordPress theme, specifically in versions prior to 1.10. This vulnerability arises from the theme's improper handling of untrusted data, which could potentially be exploited to inject malicious objects.

Impact

Exploitation of this vulnerability could lead to PHP object injection, allowing for various types of code injection, such as SQL injection, path traversal, or denial-of-service, especially if a suitable property-oriented programming chain is available.

Remediation

Users are advised to update the Pelicula WordPress theme to version 1.10 or later. Patchstack has also issued a mitigation rule to block attacks targeting this vulnerability.