CVE-2023-46149

CVE-2023-46149 affects Themify Ultra (WordPress Theme) and is caused by an Unrestricted Upload of File with Dangerous Type in Themify Ultra, impacting versions up to 7.3.5. The vulnerability enables arbitrary file upload, which could lead to remote code execution or full site compromise given an ...

CVE-2023-46149 WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to Arbitrary File Upload

Unrestricted Upload of File with Dangerous Type vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5...

CVE-2023-46147

Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5...

CVE-2023-46147

Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5...

Deserialization of untrusted data

Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5...

CVE-2023-46147 WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5...

CVE-2023-46147 WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5...

CVE-2023-46147

CVE-2023-46147 affects Themify Ultra (WordPress theme) up to version 7.3.5. Root cause: deserialization of untrusted data leading to PHP Object Injection. Impact is described as High (C/H/I/H). Patch/mitigation: upgrade to Themify Ultra 7.3.6 or later; Patchstack also notes the fix in 7.3.6. Expl...

WordPress Plugin Themify Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

PT-2023-29876 · Themify · Themify Ultra

Name of the Vulnerable Software and Affected Versions: Themify Ultra versions through 7.3.5 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects Themify Ultra. No information is provided about the estimated number of potentially affected devices...

WordPress Plugin Themify Code Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...

PT-2023-29875 · Themify · Themify Ultra

Name of the Vulnerable Software and Affected Versions: Themify Ultra versions n/a through 7.3.5 Description: The issue is related to the deserialization of untrusted data. This can potentially lead to security risks, as deserializing untrusted data can allow an attacker to execute malicious code...

Themify Ultra < 7.3.6 - Missing Authorization

Description The themify-ultra theme for WordPress is vulnerable to unauthorized access, modification or loss of data due to a missing capability check on an unknown function in all versions up to, and including, 7.3.3. This makes it possible for authenticated attackers with subscriber access or...

Themify Ultra < 7.3.6 - Authenticated (Subscriber+) PHP Object Injection

Description The themify-ultra theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.3.3 via deserialization of untrusted input. This makes it possible for authenticated attackers with subscriber access and above to inject a PHP Object. If a POP chain is...

Themify Ultra < 7.3.6 - Privilege Escalation

Description The themify-ultra theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.3.3. This makes it possible for low-level attackers with subscriber-level access to elevate their privileges...

Themify Ultra < 7.3.6 - Missing Authorization

Description The Themify Ultra theme for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on one of its functions in versions up to, and including, 7.3.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to ma...

Themify Ultra < 7.3.6 - Authenticated (Subscriber+) Arbitrary File Upload

Description The themify-ultra theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in during a file upload in all versions up to, and including, 7.3.3. This makes it possible for authenticated attackers with subscriber access or higher to upload arbitrar...

WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to Broken Access Control

Software Themify Ultra Type Theme Vulnerable versions = 7.3.5 Fixed in 7.3.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-46146 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID dba7a9d87836 Credits Rafie Muhammad Patchstack...

WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to PHP Object Injection

Software Themify Ultra Type Theme Vulnerable versions = 7.3.5 Fixed in 7.3.6 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2023-46147 Patch priority High CVSS severity High 7.4 Developer Claim ownership PSID ae279380be0f Credits Rafie Muhammad Patchstack Required privileg...

WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to Arbitrary File Upload

Software Themify Ultra Type Theme Vulnerable versions = 7.3.5 Fixed in 7.3.6 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-46149 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 04def42b7ff1 Credits Rafie Muhammad Patchstack Required privile...