Themeton Lagom CVE-2025-60229
CRITICALSeverity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Remote unauthenticated request reaches an unserialize() sink, but real code execution requires a present POP gadget chain, justifying AC:H while retaining full CIA impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection.
This issue affects Lagom: from n/a through 2.0.
AnalysisAI
PHP object injection in the Themeton Lagom WordPress theme (versions up to and including 2.0) allows remote attackers to trigger unsafe deserialization of attacker-controlled data, potentially leading to full site compromise. The flaw is reported by Patchstack and carries a critical CVSS of 9.8 (AV:N/AC:L/PR:N/UI:N); no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Technical ContextAI
Lagom is a commercial WordPress theme distributed by Themeton (CPE cpe:2.3:a:themeton:lagom). The root cause is CWE-502 (Deserialization of Untrusted Data): the theme passes attacker-influenced input into PHP's unserialize() (or an equivalent path), enabling Object Injection. In WordPress ecosystems this typically becomes exploitable when a 'POP gadget chain' is reachable through bundled libraries, the WordPress core, or other active plugins - the deserialization primitive itself becomes RCE, arbitrary file write, or SQLi depending on which __wakeup/__destruct gadgets are present in the running site.
RemediationAI
No vendor-released patch identified at time of analysis - the Patchstack record only lists vulnerable versions 'through 2.0' without naming a fixed release, so administrators should monitor https://patchstack.com/database/wordpress/theme/lagom/vulnerability/wordpress-lagom-theme-2-0-php-object-injection-vulnerability and the Themeton vendor channel for an updated theme build and upgrade as soon as one is published. Until a fix is available, compensating controls include deploying a WordPress-aware WAF rule (Patchstack/Wordfence) to block serialized PHP payloads (strings containing 'O:' / 'a:' object markers) on theme endpoints, switching to a different theme on internet-facing sites where feasible, and restricting any AJAX or admin endpoints registered by Lagom via .htaccess or reverse-proxy ACLs - note that aggressive serialized-payload filtering can break legitimate plugins that pass serialized data, so test in staging first.
Share
External POC / Exploit Code
Leaving vuln.today