EUVD-2025-19314Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network vector, low complexity, subscriber-level privileges, full impact from object injection.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in uxper Sala allows Object Injection. This issue affects Sala: from n/a through 1.1.3.
AnalysisAI
Authenticated PHP object injection in the Sala WordPress theme (versions ≤1.1.3) enables remote code execution or data manipulation. Attackers with subscriber-level access can exploit insecure deserialization of untrusted data to inject arbitrary PHP objects. No active exploitation or public exploit code is currently known, and the EPSS score indicates low exploitation probability (0.16%).
Technical ContextAI
This CWE-502 (Deserialization of Untrusted Data) vulnerability arises when the Sala WordPress theme unsafely unserializes user-supplied data. PHP’s magic methods, combined with available gadget chains in the theme or other installed plugins, can lead to arbitrary code execution, path traversal, or database modification. CPE data is not provided, but affected product is the ‘Sala’ WordPress theme from version n/a through 1.1.3, as per the Patchstack advisory.
RemediationAI
No vendor‑released patch version has been identified at time of analysis. The primary remediation is to replace the Sala theme with a securely‑coded alternative. As a temporary measure, restrict user registration to prevent unauthenticated subscriber creation, disable the theme entirely, or deploy a web application firewall rule blocking common PHP deserialization payload patterns (e.g., ‘O:’, ‘C:’ sequences in request parameters). Monitor the theme’s repository or Patchstack for an update containing the fix.
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today