EUVD-2025-208862CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Deserialization of Untrusted Data vulnerability in Themeton Finag allows Object Injection.This issue affects Finag: from n/a through 1.5.0.
Analysis
A deserialization of untrusted data vulnerability in the Themeton Finag WordPress theme allows remote attackers to inject malicious PHP objects without authentication. This affects all versions of Finag through 1.5.0. The vulnerability carries a critical CVSS score of 9.8 due to network-based exploitation requiring no privileges or user interaction, enabling attackers to achieve complete compromise of confidentiality, integrity, and availability.
Technical Context
This vulnerability stems from CWE-502 (Deserialization of Untrusted Data), where the Finag WordPress theme processes serialized PHP data from untrusted sources without proper validation. PHP object injection occurs when user-controlled serialized strings are passed to the unserialize() function, allowing attackers to instantiate arbitrary objects and trigger magic methods (__wakeup, __destruct, __toString) with attacker-controlled properties. This can lead to remote code execution, SQL injection, or file manipulation depending on available classes in the application. The Finag theme is a WordPress theme product developed by Themeton, and the vulnerability exists in versions up to and including 1.5.0.
Affected Products
The Themeton Finag WordPress theme is affected in all versions from the initial release through version 1.5.0. According to ENISA EUVD-2025-208862, the affected version range is documented as Finag n/a through 1.5.0, indicating the vulnerability exists across the entire version history of the product. The vulnerability details and technical analysis are available in the Patchstack vulnerability database at https://patchstack.com/database/wordpress/theme/finag/vulnerability/wordpress-finag-theme-1-5-0-php-object-injection-vulnerability?_s_id=cve.
Remediation
Users of the Themeton Finag WordPress theme should immediately upgrade to a version newer than 1.5.0 if available, or discontinue use of the theme until a security patch is released. Consult the Patchstack vulnerability database entry at https://patchstack.com/database/wordpress/theme/finag/vulnerability/wordpress-finag-theme-1-5-0-php-object-injection-vulnerability?_s_id=cve for the latest patch status and remediation guidance. As an interim mitigation measure, consider implementing web application firewall rules to block requests containing serialized PHP objects (patterns like 'O:' followed by integers indicating object serialization), restrict administrative access to the WordPress installation via IP allowlisting, and monitor server logs for suspicious deserialization attempts. Given the critical nature of this unauthenticated remote code execution vulnerability, priority should be given to removing or replacing the Finag theme if an official patch is not yet available.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today