What is the CVSS score of CVE-2025-64233?

CVE-2025-64233 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of BoldThemes Codiqa are affected by CVE-2025-64233?

The BoldThemes Codiqa WordPress theme, if deployed in our environment, carries a critical unauthenticated PHP object injection vulnerability (CVE-2025-64233) affecting all versions below 1.2.8,…

How to fix or mitigate CVE-2025-64233?

Within 24 hours, inventory all WordPress instances for the BoldThemes Codiqa theme and identify any version below 1.2.8 affected by CVE-2025-64233; if found, disable the theme or take the affected site offline if it is not business-critical, and enable detailed web server and WordPress logging. Within 7 days, deploy WAF virtual patching rules to block PHP object injection and unsafe deserialization attempts, update WordPress core and all plugins to reduce available gadget chains, remove unused themes and plugins, restrict access to wp-admin and theme files, and conduct a compromise assessment on any exposed site. Within 30 days, evaluate replacing the Codiqa theme with a maintained alternative, monitor the vendor for a fixed release (1.2.8 or later per the affected version range) and apply it immediately when available, and if no patch is released, plan permanent removal of the theme; continue monitoring for exploitation attempts and review overall WordPress security posture.

BoldThemes Codiqa CVE-2025-64233

CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-12-18 audit@patchstack.com

PHP WordPress Deserialization Wordpress Theme

9.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable unserialize() sink (AV:N/PR:N/UI:N); retaining C:H/I:H/A:H matches the object-injection class though full impact presumes an available gadget chain.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Metadata Corrected

Sep 26, 2026 - 00:40 vuln.today

tag: PHP added

Analysis Generated

Sep 25, 2026 - 23:44 vuln.today

CVE Published

Dec 18, 2025 - 08:16 cve.org

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in BoldThemes Codiqa codiqa allows Object Injection.This issue affects Codiqa: from n/a through < 1.2.8.

AnalysisAI

PHP object injection in the BoldThemes Codiqa WordPress theme allows unauthenticated remote attackers to inject arbitrary PHP objects into the application through unsafe deserialization of untrusted data. All versions below 1.2.8 are affected, and per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8 Critical) no authentication or user interaction is required to reach the vulnerable unserialize() sink. No public exploit code has been identified at time of analysis and the vulnerability is not confirmed as actively exploited (no CISA KEV entry); EPSS is low at 0.38% (29th percentile), though that score likely reflects the narrow install base of this commercial theme rather than limited technical severity, and real-world impact is bounded by whether a usable POP gadget chain exists in the theme, an installed plugin, or WordPress core.

Technical ContextAI

The root cause is CWE-502, Deserialization of Untrusted Data, in the BoldThemes Codiqa WordPress theme prior to version 1.2.8. The theme passes attacker-influenced input into PHP's unserialize() (or an equivalent serialization handler), permitting PHP Object Injection. When crafted serialized payloads are processed, PHP instantiates attacker-chosen classes and triggers their magic methods (__wakeup, __destruct, __toString, etc.). The severity of object injection is context-dependent: by itself it may only produce object instantiation, but when a viable POP (property-oriented programming) gadget chain exists somewhere in the loaded codebase - the theme, an installed plugin, or WordPress core - it can escalate to remote code execution, arbitrary file write/delete, or SQL injection. The CPE/version boundary indicates the flaw spans all Codiqa releases prior to 1.2.8, and the disclosure originates from Patchstack (audit@patchstack.com), the standard channel for WordPress theme and plugin vulnerability reporting. The CVSS scope is Unchanged (S:U), meaning the attacker's authority is assumed to remain within the vulnerable component.

Affected ProductsAI

The BoldThemes Codiqa WordPress theme is affected in all versions from n/a through versions earlier than 1.2.8, i.e. any installation running Codiqa < 1.2.8 is vulnerable. Codiqa is a commercial WordPress theme from BoldThemes, so affected sites are those with the theme installed and active; the vulnerability resides in the theme code itself rather than in WordPress core. Patchstack tracks the issue as the 'WordPress Codiqa Theme 1.2.8 PHP Object Injection Vulnerability' and the advisory at https://patchstack.com/database/Wordpress/Theme/codiqa/vulnerability/wordpress-codiqa-theme-1-2-8-php-object-injection-vulnerability?_s_id=cve should be consulted for the vendor-supplied version matrix and any additional affected-version detail.

RemediationAI

Upgrade the BoldThemes Codiqa theme to version 1.2.8 or later, which is the vendor-released fix boundary for this issue; theme updates are typically delivered through the BoldThemes customer account or the WordPress dashboard for licensed installs. Verify the theme version after updating (Appearance > Themes, or check the style.css header) to confirm the running build is >= 1.2.8. If immediate upgrading is not possible, compensating controls should focus on cutting off the unauthenticated attack path: deploy a WAF or virtual-patching rule that blocks serialized-object payloads ('O:' patterns in request parameters) targeting the theme, restrict or temporarily deactivate the Codiqa theme if it is not business-critical, and reduce the gadget surface by removing unused plugins and keeping WordPress core and all other plugins current - this last step does not remove the vulnerable sink but lowers the odds that an attacker can assemble a POP chain that turns object injection into RCE or file write. Sites should also monitor for unexpected files in upload directories and review PHP error logs for unserialize() warnings, since successful gadget-chain exploitation typically leaves those traces. Full advisory details and patch guidance are available at https://patchstack.com/database/Wordpress/Theme/codiqa/vulnerability/wordpress-codiqa-theme-1-2-8-php-object-injection-vulnerability?_s_id=cve.