What is the CVSS score of CVE-2025-31069?

CVE-2025-31069 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of HotStar WordPress Theme are affected by CVE-2025-31069?

CVE-2025-31069 is a critical remote code execution vulnerability in HotStar WordPress theme versions up to 1.4 that allows unauthenticated attackers to compromise entire websites through PHP object…

How to fix or mitigate CVE-2025-31069?

Within 24 hours: Identify all WordPress instances using HotStar theme and document current versions via wp-cli or admin dashboard. Within 7 days: Disable or remove HotStar theme immediately if version 1.4 or earlier is detected; apply a hardened alternative theme and verify removal via file system audit. Within 30 days: Implement Web Application Firewall (WAF) rules to block PHP deserialization payloads; conduct full website integrity audit and malware scan using tools such as WordFence or Sucuri; review access logs from past 90 days for exploitation indicators.

HotStar WordPress Theme CVE-2025-31069

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-05-23 audit@patchstack.com

WordPress Deserialization Wordpress Theme

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 28, 2026 - 20:10 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 18:43 vuln.today

CVE Published

May 23, 2025 - 13:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in themeton HotStar - Multi-Purpose Business Theme allows Object Injection. This issue affects HotStar - Multi-Purpose Business Theme: from n/a through 1.4.

AnalysisAI

PHP object injection in HotStar WordPress theme (versions up to 1.4) allows remote unauthenticated attackers to achieve full system compromise through deserialization of untrusted data. The CVSS 9.8 critical rating reflects network-based exploitation requiring no authentication or user interaction, though EPSS scoring at 0.37% (59th percentile) indicates relatively low observed exploitation probability. Patchstack reported this vulnerability, and while no CISA KEV listing exists, the trivial attack complexity (AC:L) combined with the WordPress theme context suggests potential for automated scanning and exploitation if gadget chains are present in the target environment.

Technical ContextAI

This vulnerability stems from unsafe deserialization (CWE-502) where the HotStar WordPress theme processes serialized PHP data from untrusted sources without proper validation. PHP object injection occurs when an application unserializes user-controlled input, allowing attackers to instantiate arbitrary objects and trigger magic methods like __wakeup() or __destruct(). The exploitation success depends on the presence of exploitable 'gadget chains' - sequences of existing classes in WordPress core, plugins, or the theme itself that can be chained together to achieve code execution, file manipulation, or SQL injection. WordPress themes commonly deserialize data in settings import/export features, AJAX handlers, or custom meta fields, making them frequent targets for this vulnerability class.

Affected ProductsAI

The vulnerability affects HotStar Multi-Purpose Business Theme for WordPress in all versions from an unspecified initial release through version 1.4. This is a commercial WordPress theme developed by themeton, distributed through ThemeForest or similar marketplaces. Users can verify their installation version through WordPress admin dashboard under Appearance > Themes. No CPE identifier is available for this commercial theme. The Patchstack advisory at https://patchstack.com/database/wordpress/theme/hotstar/vulnerability/wordpress-hotstar-multi-purpose-business-theme-1-4-php-object-injection-vulnerability provides additional vulnerability details.

RemediationAI

Immediately upgrade HotStar theme to version 1.4.1 or later if available from themeton or your theme marketplace provider (ThemeForest). Verify the patched version through the theme's changelog or contact themeton support directly to confirm fix availability and version number, as NVD data does not specify the exact patched release. If no patched version exists, implement these compensating controls with noted trade-offs: disable the HotStar theme entirely and switch to an alternative WordPress theme (breaks site design, requires migration effort); restrict WordPress admin access to trusted IP addresses only via .htaccess or firewall rules (mitigates remote exploitation but reduces administrative flexibility); implement Web Application Firewall rules to block requests containing serialized PHP patterns in POST/GET parameters (may cause false positives with legitimate serialized data). Consult https://patchstack.com/database/wordpress/theme/hotstar/vulnerability for specific vulnerable code paths if available to targeted patching is feasible. For high-security environments, conduct code review of theme files focusing on uses of unserialize(), maybe_unserialize(), or similar functions processing external input.