Skip to main content

Wordpress Theme CVE-2025-52724

| EUVDEUVD-2025-19295 CRITICAL
Deserialization of Untrusted Data (CWE-502)
2025-06-27 audit@patchstack.com
WordPress Deserialization Wordpress Theme
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
EUVD ID Assigned
Mar 16, 2026 - 00:16 euvd
EUVD-2025-19295
Analysis Generated
Mar 16, 2026 - 00:16 vuln.today
CVE Published
Jun 27, 2025 - 12:15 nvd
CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in BoldThemes Amwerk allows Object Injection. This issue affects Amwerk: from n/a through 1.2.0.

AnalysisAI

Remote code execution in BoldThemes Amwerk theme for WordPress versions up to 1.2.0 allows unauthenticated attackers to inject malicious PHP objects via deserialization of untrusted data, leading to full site compromise. The vulnerability has a critical CVSS score but a low EPSS probability (0.13%), with no reported active exploitation or public proof-of-concept at this time.

More in Wordpress Theme

View all
CVE-2025-1307 CRITICAL
9.8 Mar 04

The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the news
CVE-2019-25142 HIGH POC
8.8 Jun 07

The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and in
CVE-2023-45657 HIGH
8.5 Nov 06

A vulnerability in posimyththemes Nexter nexter.0.3. Rated high severity (CVSS 8.5), this vulnerability is remotely expl
CVE-2020-36721 MEDIUM POC
6.5 Jun 07

The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Acti
CVE-2024-52413 CRITICAL
9.8 Nov 16

Remote code execution in the dmcwebzone Airin Blog WordPress plugin (versions up to and including 1.6.1) is possible thr
CVE-2025-48106 CRITICAL
10.0 Oct 22

Unauthenticated arbitrary file upload in the Clanora WordPress theme (versions before 1.3.1) allows remote attackers to

CVE-2020-17362 MEDIUM POC
6.1 Aug 12

search.php in the Nova Lite theme before 1.3.9 for WordPress allows Reflected XSS. Rated medium severity (CVSS 6.1), thi
CVE-2025-49060 CRITICAL
10.0 Oct 22

Arbitrary file upload in the CMSSuperHeroes Wastia WordPress theme (all versions before 1.1.3) allows remote attackers t
CVE-2026-39770 CRITICAL
10.0 Oct 06

Unauthenticated arbitrary file upload in the Doctreat WordPress theme (versions up to and including 1.7.0) allows remote
CVE-2025-26927 CRITICAL
10.0 Apr 15

Unrestricted Upload of File with Dangerous Type vulnerability in EPC AI Hub allows Upload a Web Shell to a Web Server.3.
CVE-2026-81779 CRITICAL
10.0 Aug 31

Backdoor / malicious code implant in the Silk Themes 'Newspapers X' WordPress theme (versions 1.0.46 through 1.0.48) all
CVE-2025-49071 CRITICAL
10.0 Jun 17

Critical unrestricted file upload vulnerability in NasaTheme Flozen that allows unauthenticated remote attackers to uplo

Same weakness CWE-502 – Deserialization of Untrusted Data

View all
CVE-2021-35464 CRITICAL POC
9.8
CVE-2020-10189 CRITICAL POC
9.8
CVE-2019-18935 CRITICAL POC
9.8
CVE-2015-7450 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8
CVE-2021-42237 CRITICAL POC
9.8
CVE-2025-24016 CRITICAL POC
9.9

Same technique Deserialization

View all
CVE-2015-7450 CRITICAL POC
9.8
CVE-2025-53770 CRITICAL POC
9.8
CVE-2020-7961 CRITICAL POC
9.8
CVE-2021-42237 CRITICAL POC
9.8
CVE-2025-24016 CRITICAL POC
9.9
CVE-2020-0618 HIGH POC
8.8
CVE-2015-4852 CRITICAL POC
9.8
CVE-2025-49113 CRITICAL POC
9.9

Share

CVE-2025-52724 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy