Travelicious < 1.6.7 - Unauthenticated PHP Object Injection
highThe Travelicious theme for WordPress is vulnerable to PHP Object Injection in versions up to 1.6.7 via deserialization of untrusted input [from the vulnerable parameter?|in the vulnerable function?]. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulner...
- CVSS:
- 8.1
- Affected:
- up to 1.6.7
- Fixed in:
- 1.6.7
- Disclosed:
- Feb 9, 2026