What is the CVSS score of CVE-2025-32283?

CVE-2025-32283 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of Solar Energy are affected by CVE-2025-32283?

The designthemes Solar Energy WordPress theme (versions ≤3.5) contains a high-severity PHP object injection vulnerability that could enable code execution on affected websites, impacting…

How to fix or mitigate CVE-2025-32283?

Within 24 hours, inventory all WordPress installations for the designthemes Solar Energy theme at versions ≤3.5, confirm whether the theme is active, and if it is not business-critical, deactivate and remove it; also review user accounts with low privileges and restrict access to wp-admin and theme files. Within 7 days, for any site where the theme must remain active, deploy WAF or virtual patching rules to block PHP object injection and deserialization attempts, isolate the site from sensitive internal networks, enable detailed logging and file integrity monitoring, and perform a compromise assessment for signs of code execution. Within 30 days, continue tracking the vendor for a fixed version, plan migration to a supported alternative theme or an updated release once available, and if no patch is issued, formalize a risk acceptance or removal plan with executive sign-off.

Solar Energy CVE-2025-32283

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Theme

8.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable deserialization needing a low-privilege authenticated account (PR:L), low complexity, no user interaction, with object injection enabling high C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 13:24 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in designthemes Solar Energy solar allows Object Injection.This issue affects Solar Energy: from n/a through <= 3.5.

AnalysisAI

Deserialization of untrusted data in the designthemes Solar Energy WordPress theme (versions ≤ 3.5) allows authenticated attackers with low privileges to trigger PHP object injection, potentially leading to code execution or other high-impact effects. The vulnerability has a CVSS score of 8.8, but exploitation requires the theme to be active and a suitable gadget chain to be present; no public exploit code or active exploitation has been identified, and EPSS estimates a 0.61% likelihood of exploitation in the next 30 days. No fixed version is currently documented, so mitigation depends on removing or restricting access to the theme.

Technical ContextAI

The vulnerability is a classic PHP object injection (CWE-502) in a WordPress theme. WordPress themes are PHP applications that can deserialize data, and when untrusted input is passed to unserialize(), an attacker can inject arbitrary PHP objects. If the theme or any installed plugin contains classes with magic methods like __wakeup or __destruct, these can be abused as a gadget chain to achieve remote code execution, file deletion, or other malicious actions. The attack requires an authenticated session with at least a low-privilege role (PR:L), as the vulnerable endpoint is presumably accessible only to logged-in users. The theme is 'Solar Energy' by designthemes, affecting versions up to and including 3.5. No CPE is provided, but the vendor advisory is available from Patchstack.

Affected ProductsAI

The designthemes Solar Energy WordPress theme, versions up to and including 3.5, is affected. No CPE string is provided. The vendor advisory is at Patchstack: https://patchstack.com/database/Wordpress/Theme/solar/vulnerability/wordpress-solar-energy-3-5-php-object-injection-vulnerability?_s_id=cve

RemediationAI

No vendor-released patch is identified at time of analysis. Because no fixed version exists, the safest course is to remove or disable the Solar Energy theme if it is not essential. If the theme must remain active, restrict access to theme endpoints to trusted authenticated users only (e.g., by limiting user roles or IP addresses), understanding that this reduces but does not eliminate the risk. Monitor the Patchstack advisory (https://patchstack.com/database/Wordpress/Theme/solar/vulnerability/wordpress-solar-energy-3-5-php-object-injection-vulnerability?_s_id=cve) for updates and apply a patched version as soon as it is released. Implementing a web application firewall (WAF) with rules to detect deserialization attacks may provide temporary mitigation, but WAFs can be bypassed and should not be relied upon as a sole defense.