What is the CVSS score of CVE-2025-31634?

CVE-2025-31634 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Designthemes Insurance are affected by CVE-2025-31634?

The designthemes Insurance theme for WordPress (versions ≤ 3.5) is affected by a high-severity PHP object injection flaw that requires an authenticated low-privileged account and could lead to full…

How to fix or mitigate CVE-2025-31634?

Within 24 hours, inventory all WordPress sites running the designthemes Insurance theme at versions ≤ 3.5, deactivate or remove the theme where possible, and temporarily restrict registration while removing or downgrading untrusted low-privileged accounts; if removal is not feasible, apply emergency WAF rules blocking PHP object injection or unserialize abuse against the theme and enable enhanced logging. Within 7 days, confirm no site still runs affected versions, replace the theme with a supported alternative or isolate it, review authentication and role policies to limit low-privileged access, scan for webshells or indicators of compromise, and monitor the vendor for a fixed version. Within 30 days, migrate all affected sites off the vulnerable theme versions, apply the vendor patch immediately once released, conduct a forensic review of any sites that could not be remediated quickly, and update patch-management and third-party theme governance to prevent similar exposure.

Designthemes Insurance CVE-2025-31634

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Theme

8.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable (AV:N) object injection with low complexity (AC:L), but requires an authenticated low-privileged account (PR:L); successful object injection can yield full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 13:25 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects Insurance: from n/a through <= 3.5.

AnalysisAI

PHP Object Injection in the designthemes Insurance theme (versions ≤ 3.5) for WordPress allows authenticated attackers with low-level privileges to inject arbitrary PHP objects via unserialize() of untrusted data, potentially leading to remote code execution if a POP gadget chain exists. The CVSS 3.1 base score is 8.8, reflecting high confidentiality, integrity, and availability impact; exploitation requires an authenticated session (PR:L) and no user interaction (UI:N). EPSS score is 0.63% (48th percentile) and there is no public exploit identified at time of analysis (no KEV, no POC).

Technical ContextAI

The vulnerability is a PHP Object Injection (CWE-502: Deserialization of Untrusted Data) in the designthemes 'Insurance' WordPress theme. The theme passes attacker-controlled input to PHP's unserialize() function without proper validation. When unserialize() processes malicious serialized data, it can instantiate arbitrary objects and trigger magic methods such as __wakeup or __destruct. If a POP (Property-Oriented Programming) gadget chain exists in the theme or co-installed plugins, this can escalate to remote code execution, file deletion, or other severe impacts. The affected component is a commercial WordPress theme, not WordPress core. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates network reachability, low attack complexity, and mandatory authentication with at least low privileges (e.g., subscriber or contributor).

Affected ProductsAI

The affected product is the designthemes 'Insurance' theme for WordPress, all versions from n/a through 3.5 (i.e., versions ≤ 3.5). No CPE string is provided in the input data. The vendor advisory is available at the Patchstack database: https://patchstack.com/database/Wordpress/Theme/insurance/vulnerability/wordpress-insurance-3-5-php-object-injection-vulnerability?_s_id=cve.

RemediationAI

No vendor-released patch is identified in the provided data at time of analysis; the advisory indicates the vulnerability affects versions up to and including 3.5, so users should check the Patchstack advisory and the vendor's site for an updated version (likely >3.5). As a compensating control, restrict access to the vulnerable theme input path to only trusted users, or temporarily disable the theme if it is not critical, though this may impact site appearance and functionality. Because authentication is mandatory for exploitation, strictly limit the number of low-privileged accounts (subscriber/contributor roles) on the WordPress site. Monitor the Patchstack advisory for patch availability: https://patchstack.com/database/Wordpress/Theme/insurance/vulnerability/wordpress-insurance-3-5-php-object-injection-vulnerability?_s_id=cve.