What is the CVSS score of CVE-2025-69108?

CVE-2025-69108 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Which versions of Hot Coffee are affected by CVE-2025-69108?

The ThemeREX Hot Coffee WordPress theme (versions 1.7 and below) contains a critical unauthenticated remote code execution vulnerability that allows attackers to inject malicious PHP objects without…

How to fix or mitigate CVE-2025-69108?

Within 24 hours: Audit all WordPress installations to identify sites running ThemeREX Hot Coffee version 1.7 or earlier; immediately disable the vulnerable theme and activate an alternative. Within 7 days: Migrate all affected sites to a patched WordPress theme version (vendor is not currently providing a fixed version; choose alternative proven-secure theme such as Neve, GeneratePress, or OceanWP). Within 30 days: Conduct forensic analysis of access logs for exploitation indicators; restore from clean, pre-compromise backups if any evidence of malicious activity is detected; implement Web Application Firewall rules to block future exploitation attempts.

Hot Coffee CVE-2025-69108

EUVD-2025-210191 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2026-06-16 Patchstack

PHP Deserialization Hot Coffee

9.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Description states unauthenticated PHP object injection over the network with no user interaction; deserialization gadgets typically enable full RCE, so C/I/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 00:05 vuln.today

DescriptionCVE.org

Unauthenticated PHP Object Injection in Hot Coffee <= 1.7 versions.

Articles & Coverage 1

News Critical PHP Object Injection in ThemeREX Hot Coffee WordPress Theme - CVE-2025-69108 Jun 17, 2026

AnalysisAI

Unauthenticated PHP Object Injection in the ThemeREX Hot Coffee WordPress theme (versions ≤ 1.7) allows remote attackers to inject arbitrary serialized PHP objects, potentially triggering property-oriented programming (POP) chains that lead to remote code execution, arbitrary file operations, or full site compromise. The flaw was disclosed by Patchstack and carries a CVSS 9.8 due to network reachability with no authentication or user interaction, though no public exploit has been identified at time of analysis.

Technical ContextAI

Hot Coffee is a commercial WordPress theme distributed by ThemeREX (CPE: cpe:2.3:a:themerex:hot_coffee). The underlying weakness is CWE-502 (Deserialization of Untrusted Data): the theme passes attacker-controlled input into PHP's unserialize() without validating that the serialized payload originates from a trusted source. When unserialize() rebuilds objects, PHP automatically invokes magic methods such as __wakeup() and __destruct() on resulting instances. If any class available in the WordPress runtime (core, other plugins, or themes loaded in the same process) contains a suitable POP gadget, the deserialization can be chained into file writes, SQL queries, or code execution. Because WordPress installations typically load many plugins/themes, gadget chains are commonly reachable in practice.

RemediationAI

No vendor-released patch identified at time of analysis - the Patchstack advisory (https://patchstack.com/database/wordpress/theme/hot-coffee/vulnerability/wordpress-hot-coffee-theme-1-7-php-object-injection-vulnerability) does not cite a fixed version in the supplied data, so administrators should check ThemeREX for a release above 1.7 and upgrade as soon as one is published. Until a vendor update is available, the most effective compensating control is to deploy the Patchstack mAX or an equivalent WordPress WAF with a virtual patch rule blocking serialized PHP payloads (strings matching patterns like O:\d+:" or a:\d+:{) on requests reaching the theme's endpoints - note this can break legitimate forms that legitimately transport serialized data. Alternatively, switch the site to a different theme until a fix ships, or restrict access to the theme's vulnerable entry points via web-server rules; auditing for unexpected admin users, scheduled tasks (wp_cron), and modified PHP files is recommended in case exploitation has already occurred.