WordPress BugsPatrol theme <= 1.5.0 - PHP Object Injection vulnerability

The BugsPatrol WordPress theme before version 1.5.1 has a flaw where it processes untrusted data without proper validation, allowing attackers to inject malicious objects into the system. This can lead to remote code execution and full compromise of the website.

The vulnerability exists in unsafe PHP deserialization of untrusted input, allowing remote attackers to instantiate arbitrary objects. No authentication is required; the attack vector is network-based via crafted serialized data. Successful exploitation results in arbitrary code execution with web server privileges.