Pelicula < 1.10 - Unauthenticated PHP Object Injection
highThe Pelicula theme for WordPress is vulnerable to PHP Object Injection in versions up to 1.10 via deserialization of untrusted input [from the vulnerable parameter?|in the vulnerable function?]. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable...
- CVSS:
- 8.1
- Affected:
- up to 1.10
- Fixed in:
- 1.10
- Disclosed:
- Mar 20, 2026