Dash WordPress Theme CVE-2025-31049
CRITICALSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in themeton Dash allows Object Injection. This issue affects Dash: from n/a through 1.3.
AnalysisAI
Remote unauthenticated attackers can achieve arbitrary PHP object injection in Dash WordPress theme versions up to 1.3 by exploiting unsafe deserialization of user-controlled data. The CVSS 9.8 score reflects network-based attack with no authentication required and complete compromise potential (confidentiality, integrity, availability). Despite the critical severity, EPSS probability is relatively low (0.37%, 59th percentile), suggesting limited observed exploitation attempts. Reported by Patchstack security research team with public vulnerability database entry available. No CISA KEV listing indicates this is not confirmed as actively exploited in the wild, though the straightforward attack vector (AV:N/AC:L/PR:N) makes it attractive for mass WordPress scanning campaigns.
Technical ContextAI
This vulnerability stems from CWE-502 (Deserialization of Untrusted Data), a dangerous class where applications process serialized PHP objects from untrusted sources without validation. WordPress themes commonly use PHP's serialize/unserialize functions for configuration storage, widget data, or session management. When unserialize() processes attacker-controlled input, magic methods like __wakeup(), __destruct(), or __toString() execute automatically during object reconstruction. The Dash theme (by themeton) lacks proper input sanitization on deserialization endpoints, allowing injection of malicious object chains. Available CPE data does not specify exact affected component within the theme, but Patchstack references indicate this is a theme-level vulnerability rather than a specific plugin. PHP object injection serves as a primitive that can chain with existing code (POP chains) to achieve remote code execution, SQL injection, or file manipulation depending on what classes are available in the WordPress installation.
Affected ProductsAI
Dash WordPress theme by themeton, all versions from unspecified starting point through version 1.3 inclusive. CPE identifier not provided in available data. Patchstack vulnerability database entry (reference URLs) indicates this affects the theme component, not a companion plugin. Organizations can verify installation by checking wp-content/themes/dash/ directory and examining style.css header for version number. Vendor advisory or official themeton security bulletin not identified in provided references - primary disclosure appears through Patchstack third-party research platform.
RemediationAI
Upgrade Dash WordPress theme to version 1.4 or later if available (exact patched version not confirmed in provided data - verify with themeton or WordPress theme repository). Access Patchstack database entry at https://patchstack.com/database/wordpress/theme/dash/vulnerability/wordpress-dash-1-3-php-object-injection-vulnerability for latest remediation guidance. If immediate patching is not feasible, implement compensating controls: (1) Disable or remove Dash theme entirely if not actively used, switching to a maintained alternative - this eliminates attack surface completely but requires theme migration effort and potential site redesign; (2) Implement Web Application Firewall (WAF) rules to block requests containing serialized PHP object patterns (look for 'O:' followed by digits in POST/GET parameters) - this may cause false positives if legitimate theme features use serialization, requiring rule tuning; (3) Restrict WordPress admin access to trusted IP ranges via .htaccess or network firewall - reduces exposure but does not prevent exploitation if vulnerability exists in public-facing theme endpoints; (4) Enable PHP disable_functions directive to block dangerous functions like exec, system, passthru which are common POP chain targets - may break legitimate plugins, test thoroughly in staging environment. Note that deserialization vulnerabilities are difficult to mitigate without code-level fixes, making vendor patching the only complete solution.
Share
External POC / Exploit Code
Leaving vuln.today