EUVD-2025-17502Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in themeton PressGrid - Frontend Publish Reaction & Multimedia Theme allows Object Injection. This issue affects PressGrid - Frontend Publish Reaction & Multimedia Theme: from n/a through 1.3.1.
AnalysisAI
Remote code execution vulnerability in PressGrid WordPress Theme versions through 1.3.1 allows unauthenticated attackers to inject arbitrary PHP objects via insecure deserialization, potentially leading to full site compromise. The vulnerability exploits improper validation of serialized user input - a common attack vector in WordPress themes and plugins. CVSS 9.8 critical severity is supported by network attack vector requiring no privileges, though EPSS score of 0.14% (34th percentile) and absence from CISA KEV suggest limited active exploitation. Patchstack, a WordPress security vendor, identified and disclosed this flaw.
Technical ContextAI
The vulnerability stems from CWE-502 (Deserialization of Untrusted Data), where the PressGrid theme accepts serialized PHP data from untrusted sources without proper validation. PHP object injection occurs when unserialize() is called on attacker-controlled input, allowing instantiation of arbitrary classes with malicious properties. In WordPress environments, this often chains with existing classes (gadget chains) to achieve remote code execution, file manipulation, or SQL injection. The PressGrid theme, designed for frontend content publishing and multimedia features, likely deserializes user session data, form inputs, or AJAX request parameters insecurely. Affected versions span from unknown earliest release through confirmed vulnerable version 1.3.1. No CPE data available, but product identified as WordPress theme from themeton vendor.
RemediationAI
Upgrade PressGrid theme to version 1.3.2 or later if available from themeton vendor - patch version not independently confirmed from available data sources, recommend checking ThemeForest product page or contacting vendor directly at https://themeforest.net/user/themeton for latest secure release. If immediate patching unavailable, implement compensating controls: disable PressGrid theme and switch to alternative WordPress theme until patch confirmed; restrict WordPress admin access to trusted IP addresses via .htaccess or firewall rules to limit attack surface; enable WordPress application firewall (WAF) with rules detecting unserialize() in POST/GET parameters (ModSecurity CRS or Wordfence/Sucuri WAF); monitor PHP error logs for deserialization warnings and object injection attempts. Note that disabling theme functionality breaks frontend publishing features, requiring content workflow adjustments. WAF rules may generate false positives on legitimate serialized session data, requiring tuning.
Share
External POC / Exploit Code
Leaving vuln.today