A critical PHP object injection vulnerability in the Theme-Rex FreightCo theme exposes sites to unauthenticated remote code execution.

The theme fails to properly sanitize input, leading to a deserialization of untrusted data (CWE-502) vulnerability that can be triggered by unauthenticated actors.

With a CVSS score of 9.8, this vulnerability represents a critical risk to business operations. Exploitation could allow an attacker to execute arbitrary code, resulting in total data loss, unauthorized administrative access, or the deployment of persistent backdoors on the web server.

Immediate Action: Check the vendor website for available security updates and apply them immediately, or consider switching to a different theme if a patch is not available.

Proactive Monitoring: Monitor server logs for suspicious activity and unexpected file modifications that may indicate successful exploitation or post-exploitation activity.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter out suspicious serialized object payloads aimed at the theme, providing a temporary layer of defense.

Public Exploit Available: Unknown

Given the critical nature of this vulnerability, administrators should audit their installations to ensure the theme is updated if a fix is provided by Theme-Rex. If no patch is currently available, the theme should be disabled until a secure version is released to prevent unauthorized access.