Hillter CVE-2025-24777
HIGHSeverity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Authentication as a low‑privilege user is required (PR:L); otherwise network exploitation is straightforward with no complexity or user interaction, leading to total compromise.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in awethemes Hillter hillter allows Object Injection.This issue affects Hillter: from n/a through <= 3.0.7.
AnalysisAI
Object injection via PHP deserialization in the Hillter WordPress theme (versions ≤ 3.0.7) allows authenticated attackers with low‑privilege accounts to execute arbitrary code or modify site data. No active exploitation or public exploit code has been identified at time of analysis, and EPSS exploitation probability is low (0.16%).
Technical ContextAI
The vulnerability resides in the awethemes Hillter theme for WordPress and stems from insecure deserialization of user‑supplied data (CWE‑502). When the theme processes untrusted serialized PHP objects, it can trigger arbitrary code execution, file operations, or database manipulation. The affected product is a niche WordPress theme distributed on standard marketplaces.
Affected ProductsAI
awethemes Hillter WordPress theme, all versions from n/a through 3.0.7. No official CPE string is provided in the CVE entry. Vendor advisory reference available via Patchstack.
RemediationAI
No confirmed patch version is available in the CVE record. Immediately check the Patchstack advisory for an updated theme release and upgrade to a version higher than 3.0.7 if released. As a temporary workaround, deactivate the Hillter theme on your WordPress site and switch to a safe theme until a secure version is confirmed. Monitor vendor communications for an official fix.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today