What is the CVSS score of CVE-2025-52826?

CVE-2025-52826 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Sala Theme are affected by CVE-2025-52826?

Organizations using Deserialization of Untrusted Data vulnerability in uxper Sala face significant risk from CVE-2025-52826, a insecure deserialization vulnerability rated CVSS 8.8.

How to fix or mitigate CVE-2025-52826?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Restrict deserialization to trusted data sources and implement integrity checks.

Sala Theme CVE-2025-52826

EUVD-2025-19314 HIGH

Deserialization of Untrusted Data (CWE-502)

2025-06-27 audit@patchstack.com

WordPress Deserialization Wordpress Theme

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network vector, low complexity, subscriber-level privileges, full impact from object injection.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 00:16 euvd

EUVD-2025-19314

Analysis Generated

Mar 16, 2026 - 00:16 vuln.today

CVE Published

Jun 27, 2025 - 12:15 nvd

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in uxper Sala allows Object Injection. This issue affects Sala: from n/a through 1.1.3.

AnalysisAI

Authenticated PHP object injection in the Sala WordPress theme (versions ≤1.1.3) enables remote code execution or data manipulation. Attackers with subscriber-level access can exploit insecure deserialization of untrusted data to inject arbitrary PHP objects. No active exploitation or public exploit code is currently known, and the EPSS score indicates low exploitation probability (0.16%).

Technical ContextAI

This CWE-502 (Deserialization of Untrusted Data) vulnerability arises when the Sala WordPress theme unsafely unserializes user-supplied data. PHP’s magic methods, combined with available gadget chains in the theme or other installed plugins, can lead to arbitrary code execution, path traversal, or database modification. CPE data is not provided, but affected product is the ‘Sala’ WordPress theme from version n/a through 1.1.3, as per the Patchstack advisory.

RemediationAI

No vendor‑released patch version has been identified at time of analysis. The primary remediation is to replace the Sala theme with a securely‑coded alternative. As a temporary measure, restrict user registration to prevent unauthenticated subscriber creation, disable the theme entirely, or deploy a web application firewall rule blocking common PHP deserialization payload patterns (e.g., ‘O:’, ‘C:’ sequences in request parameters). Monitor the theme’s repository or Patchstack for an update containing the fix.