Description

Deserialization of Untrusted Data vulnerability in ThemeREX Group IPharm ipharm allows Object Injection.This issue affects IPharm: from n/a through 1.2.4.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-10-10T08:17:06.060Z",
  "pubdate": "2026-10-10T08:17:06.060Z",
  "executiveSummary": "The IPharm theme by ThemeREX Group is susceptible to an Object Injection vulnerability resulting from the insecure deserialization of untrusted data.\nThis vulnerability impacts all versions of IPharm from n/a through 1.2.4.\nBy supplying malicious serialized objects to the application, an unauthenticated or authenticated attacker can manipulate application logic, potentially leading to Remote Code Execution (RCE), arbitrary file deletion, or denial of service, depending on the available gadget chains within the application's PHP environment.\nThis poses a critical risk to the confidentiality, integrity, and availability of the host server.\nSuccessful exploitation requires the application to unserialize user-controlled input without sufficient validation or sanitization, allowing the attacker to instantiate unauthorized objects and trigger unintended side effects within the application runtime.",
  "technicalDetails": "The vulnerability resides in the improper handling of serialized data by the IPharm theme. In PHP, the unserialize() function converts a stored string representation of an object back into a PHP object. When an application passes user-supplied input—such as data derived from HTTP POST parameters, cookies, or database records—directly into unserialize() without strict validation, it creates an Object Injection vulnerability.\nThe root cause is the lack of a secure deserialization mechanism that enforces type checking or restricts the classes that can be instantiated during the unserialization process. Because PHP's unserialization mechanism invokes magic methods (such as __wakeup() or __destruct()) automatically upon instantiation, an attacker can leverage these methods to execute arbitrary code or manipulate object properties.\nThe exploitation flow involves the attacker crafting a malicious serialized payload. This payload is structured to represent a specific class existing within the application's codebase or an included library (the 'gadget chain'). By carefully constructing this object, the attacker can influence the state of the application when the object is reconstituted. If the application environment contains classes with magic methods that perform dangerous operations—such as file manipulation, database queries, or command execution—the attacker can chain these operations to achieve an exploit.\nSince the vulnerability exists in versions 1.2.4 and below, the attack vector is likely exposed via theme settings, theme-specific form processing, or other entry points where user data is processed by the theme's core functions. The threat is amplified if the application includes other third-party libraries or plugins that contain exploitable gadget chains, significantly broadening the potential impact of the injection.\nUpon successful exploitation, the payload is executed within the context of the web server process. This enables an attacker to bypass authentication mechanisms, gain administrative access, manipulate database content, or execute system-level commands, thereby leading to a full compromise of the affected WordPress site and potentially the underlying infrastructure."
}