Acerola WordPress Theme CVE-2025-31927
CRITICALSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in themeton Acerola allows Object Injection. This issue affects Acerola: from n/a through 1.6.5.
AnalysisAI
PHP object injection in Acerola WordPress theme versions up to 1.6.5 enables remote unauthenticated attackers to execute arbitrary code, manipulate application data, or cause denial of service through deserialization of untrusted data. CVSS 9.8 reflects worst-case impact (network vector, no authentication required), though EPSS score of 0.37% (59th percentile) suggests limited active targeting to date. Reported by Patchstack audit team with vulnerability details published in their database, indicating researcher-identified rather than in-the-wild discovery. No CISA KEV listing confirms exploitation remains theoretical or limited in scope.
Technical ContextAI
This vulnerability stems from unsafe PHP deserialization (CWE-502), where user-controlled data is passed to unserialize() without validation. Acerola is a WordPress theme developed by themeton, and the affected component likely involves AJAX handlers, theme options processing, or custom REST API endpoints that accept serialized objects. PHP object injection occurs when attackers craft malicious serialized strings containing objects with magic methods (__wakeup, __destruct, __toString) that trigger arbitrary code execution during deserialization. The theme's architecture allows network-accessible entry points to reach vulnerable unserialize() calls without authentication barriers, making this exploitable by any remote attacker who can identify the injection point. WordPress themes frequently introduce such vulnerabilities through custom functionality that improperly handles POST/GET parameters or cookie data.
Affected ProductsAI
WordPress theme 'Acerola' developed by themeton, versions from earliest release through 1.6.5 confirmed vulnerable per Patchstack advisory (reference: https://patchstack.com/database/wordpress/theme/acerola/vulnerability/wordpress-acerola-1-6-5-php-object-injection-vulnerability). CPE data not available in NVD records at time of analysis. All WordPress installations running Acerola theme version 1.6.5 or earlier are affected regardless of WordPress core version. Theme is typically installed on WordPress sites requiring specific design/layout features provided by themeton's commercial or free theme offerings.
RemediationAI
Immediately upgrade Acerola theme to version 1.6.6 or later if available from themeton (theme developer). Verify patch status directly with vendor at themeton's official distribution channels, as Patchstack advisory confirms vulnerability through 1.6.5 but does not explicitly document fixed release version. If patched version is unavailable or upgrade path is blocked, implement these compensating controls: (1) Disable or restrict access to theme's AJAX endpoints and custom handlers that process serialized data-review wp-admin/admin-ajax.php actions registered by Acerola and restrict via .htaccess or firewall rules to authenticated administrator sessions only (trade-off: may break theme functionality for front-end users). (2) Deploy Web Application Firewall (WAF) rules to detect and block serialized PHP objects in HTTP requests-regex patterns matching 'O:[0-9]+:' or 'a:[0-9]+:{' in POST/GET/Cookie parameters (trade-off: potential false positives on legitimate serialized WordPress data). (3) If theme features are non-critical, deactivate Acerola and migrate to alternative WordPress theme with active security maintenance. Full advisory details at Patchstack database: https://patchstack.com/database/wordpress/theme/acerola/vulnerability/wordpress-acerola-1-6-5-php-object-injection-vulnerability.
Share
External POC / Exploit Code
Leaving vuln.today