What is the CVSS score of CVE-2025-39480?

CVE-2025-39480 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Wordpress Theme are affected by CVE-2025-39480?

Organizations using Deserialization of Untrusted Data vulnerability in ThemeMakers Car Dealer face critical risk from CVE-2025-39480, a insecure deserialization vulnerability rated CVSS 9.8.

How to fix or mitigate CVE-2025-39480?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Restrict deserialization to trusted data sources and implement integrity checks.

Wordpress Theme CVE-2025-39480

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-05-23 audit@patchstack.com

WordPress Deserialization Wordpress Theme

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 16, 2026 - 14:30 vuln.today

CVE Published

May 23, 2025 - 13:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in ThemeMakers Car Dealer allows Object Injection.This issue affects Car Dealer: from n/a before 1.6.7.

AnalysisAI

A critical deserialization vulnerability in the ThemeMakers Car Dealer WordPress theme allows remote attackers to perform PHP object injection attacks without authentication. The vulnerability affects all versions of Car Dealer prior to 1.6.7 and enables complete system compromise with the ability to execute arbitrary code, steal data, or take over the website. With an EPSS score of 0.15% (35th percentile), while not currently in CISA KEV, the vulnerability presents moderate real-world exploitation risk given its network-accessible attack vector and lack of required authentication.

Technical ContextAI

This vulnerability stems from unsafe deserialization of user-controlled data, classified as CWE-502 (Deserialization of Untrusted Data). The Car Dealer theme, a WordPress automotive dealership theme by ThemeMakers, improperly handles serialized PHP objects without adequate validation. When PHP unserializes malicious data, it can instantiate arbitrary objects and potentially trigger magic methods like __wakeup() or __destruct(), leading to code execution. The vulnerability specifically enables PHP Object Injection attacks where attackers craft malicious serialized payloads to manipulate application logic or achieve remote code execution through gadget chains present in the WordPress environment.

Affected ProductsAI

The vulnerability affects ThemeMakers Car Dealer WordPress theme in all versions prior to 1.6.7. This is a commercial WordPress theme designed for automotive dealerships and car sales websites. The vulnerability was discovered and reported by audit@patchstack.com through coordinated disclosure. While no specific CPE identifier is provided in the available data, the affected product can be identified as the 'cardealer' theme in WordPress environments. The vendor has released version 1.6.7 which addresses this vulnerability.

RemediationAI

Immediately upgrade the ThemeMakers Car Dealer theme to version 1.6.7 or later, which contains the fix for this deserialization vulnerability. The patch details are available through Patchstack's vulnerability database at https://patchstack.com/database/wordpress/theme/cardealer/vulnerability/wordpress-car-dealer-1-6-6-php-object-injection-vulnerability. If immediate patching is not possible, consider temporarily disabling the theme or implementing Web Application Firewall (WAF) rules to block serialized PHP data in user inputs. Additionally, review WordPress security best practices and ensure all themes and plugins are kept up-to-date to prevent similar vulnerabilities.