What is the CVSS score of CVE-2025-24777?

CVE-2025-24777 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Hillter CVE-2025-24777

Q: Which versions of Hillter are affected by CVE-2025-24777?

Object injection via PHP deserialization in the Hillter WordPress theme (versions ≤ 3.0.7) allows authenticated attackers with low‑privilege accounts to execute arbitrary code or modify site data.

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-07-16 audit@patchstack.com

WordPress Deserialization Wordpress Theme

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Authentication as a low‑privilege user is required (PR:L); otherwise network exploitation is straightforward with no complexity or user interaction, leading to total compromise.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 19:21 vuln.today

CVE Published

Jul 16, 2025 - 12:15 cve.org

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in awethemes Hillter hillter allows Object Injection.This issue affects Hillter: from n/a through <= 3.0.7.

AnalysisAI

Object injection via PHP deserialization in the Hillter WordPress theme (versions ≤ 3.0.7) allows authenticated attackers with low‑privilege accounts to execute arbitrary code or modify site data. No active exploitation or public exploit code has been identified at time of analysis, and EPSS exploitation probability is low (0.16%).

Technical ContextAI

The vulnerability resides in the awethemes Hillter theme for WordPress and stems from insecure deserialization of user‑supplied data (CWE‑502). When the theme processes untrusted serialized PHP objects, it can trigger arbitrary code execution, file operations, or database manipulation. The affected product is a niche WordPress theme distributed on standard marketplaces.

Affected ProductsAI

awethemes Hillter WordPress theme, all versions from n/a through 3.0.7. No official CPE string is provided in the CVE entry. Vendor advisory reference available via Patchstack.

RemediationAI

No confirmed patch version is available in the CVE record. Immediately check the Patchstack advisory for an updated theme release and upgrade to a version higher than 3.0.7 if released. As a temporary workaround, deactivate the Hillter theme on your WordPress site and switch to a safe theme until a secure version is confirmed. Monitor vendor communications for an official fix.