What is the CVSS score of CVE-2025-31429?

CVE-2025-31429 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PressGrid WordPress Theme are affected by CVE-2025-31429?

PressGrid WordPress Theme versions up to 1.3.1 contain a critical remote code execution vulnerability allowing unauthenticated attackers to inject malicious PHP objects and compromise WordPress…

How to fix or mitigate CVE-2025-31429?

Within 24 hours: audit all WordPress installations for PressGrid theme usage and disable the theme if found in non-production environments. Within 7 days: contact Pressstack and monitor advisory channels for patch availability; implement Web Application Firewall (WAF) rules blocking PHP serialization payloads on affected domains; consider theme replacement with hardened alternatives. Within 30 days: migrate away from PressGrid or apply vendor patch immediately upon release; conduct forensic scan of all sites that ran vulnerable versions.

PressGrid WordPress Theme CVE-2025-31429

EUVD-2025-17502 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-06-09 audit@patchstack.com

WordPress Deserialization Wordpress Theme

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 28, 2026 - 20:04 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17502

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in themeton PressGrid - Frontend Publish Reaction & Multimedia Theme allows Object Injection. This issue affects PressGrid - Frontend Publish Reaction & Multimedia Theme: from n/a through 1.3.1.

AnalysisAI

Remote code execution vulnerability in PressGrid WordPress Theme versions through 1.3.1 allows unauthenticated attackers to inject arbitrary PHP objects via insecure deserialization, potentially leading to full site compromise. The vulnerability exploits improper validation of serialized user input - a common attack vector in WordPress themes and plugins. CVSS 9.8 critical severity is supported by network attack vector requiring no privileges, though EPSS score of 0.14% (34th percentile) and absence from CISA KEV suggest limited active exploitation. Patchstack, a WordPress security vendor, identified and disclosed this flaw.

Technical ContextAI

The vulnerability stems from CWE-502 (Deserialization of Untrusted Data), where the PressGrid theme accepts serialized PHP data from untrusted sources without proper validation. PHP object injection occurs when unserialize() is called on attacker-controlled input, allowing instantiation of arbitrary classes with malicious properties. In WordPress environments, this often chains with existing classes (gadget chains) to achieve remote code execution, file manipulation, or SQL injection. The PressGrid theme, designed for frontend content publishing and multimedia features, likely deserializes user session data, form inputs, or AJAX request parameters insecurely. Affected versions span from unknown earliest release through confirmed vulnerable version 1.3.1. No CPE data available, but product identified as WordPress theme from themeton vendor.

RemediationAI

Upgrade PressGrid theme to version 1.3.2 or later if available from themeton vendor - patch version not independently confirmed from available data sources, recommend checking ThemeForest product page or contacting vendor directly at https://themeforest.net/user/themeton for latest secure release. If immediate patching unavailable, implement compensating controls: disable PressGrid theme and switch to alternative WordPress theme until patch confirmed; restrict WordPress admin access to trusted IP addresses via .htaccess or firewall rules to limit attack surface; enable WordPress application firewall (WAF) with rules detecting unserialize() in POST/GET parameters (ModSecurity CRS or Wordfence/Sucuri WAF); monitor PHP error logs for deserialization warnings and object injection attempts. Note that disabling theme functionality breaks frontend publishing features, requiring content workflow adjustments. WAF rules may generate false positives on legitimate serialized session data, requiring tuning.