What is the CVSS score of CVE-2025-69130?

CVE-2025-69130 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Entrepreneur WordPress Theme are affected by CVE-2025-69130?

The Entrepreneur - Booking for Small Businesses WordPress theme (versions through 3.1.3) contains a critical code execution vulnerability allowing authenticated subscriber-level users to compromise…

How to fix or mitigate CVE-2025-69130?

Within 24 hours: Identify all WordPress sites using Entrepreneur - Booking theme version 3.1.3 or earlier; document active subscriber account count. Within 7 days: Deactivate the affected theme globally across all WordPress deployments, or disable subscriber account registration and restrict existing subscriber permissions until remediation is available. Within 30 days: Monitor Patchstack for vendor security updates; apply the patched theme version immediately upon release.

Entrepreneur WordPress Theme CVE-2025-69130

HIGH

Deserialization of Untrusted Data (CWE-502)

2026-06-17 Patchstack

PHP Deserialization WordPress Entrepreneur Booking For Small Businesses Wordpress Theme

8.8

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable WordPress endpoint (AV:N), low-complexity deserialization payload (AC:L), Subscriber account required (PR:L), no user interaction, and object injection typically yields full CIA impact via gadget chains.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 17, 2026 - 14:44 vuln.today

CVE Published

Jun 17, 2026 - 12:47 cve.org

HIGH 8.8

DescriptionCVE.org

Subscriber PHP Object Injection in Entrepreneur - Booking for Small Businesses WordPress Theme <= 3.1.3 versions.

AnalysisAI

PHP Object Injection in the Entrepreneur - Booking for Small Businesses WordPress theme through version 3.1.3 allows authenticated subscriber-level users to trigger unsafe deserialization, potentially leading to full site compromise. The flaw was disclosed via Patchstack and carries a CVSS 3.1 base score of 8.8 reflecting high impact on confidentiality, integrity, and availability. No public exploit identified at time of analysis.

Technical ContextAI

The vulnerability is a PHP Object Injection issue (CWE-502: Deserialization of Untrusted Data) in the Themovation 'Entrepreneur - Booking for Small Businesses' WordPress theme, identified by CPE cpe:2.3:a:themovation:entrepreneur_-_booking_for_small_businesses_wordpress_theme. PHP Object Injection occurs when user-controllable input reaches PHP's unserialize() function, allowing an attacker to instantiate arbitrary classes and trigger their magic methods (__wakeup, __destruct, __toString). In WordPress ecosystems, such flaws are commonly chained with gadget chains from WordPress core or other installed plugins/themes (POP chains) to achieve file write, SQL injection, or remote code execution outcomes.

RemediationAI

Patch status from the provided data is ambiguous - no exact fix version is enumerated, so treat this as: patch availability should be confirmed via the Patchstack advisory at https://patchstack.com/database/wordpress/theme/entrepreneurx/vulnerability/wordpress-entrepreneur-booking-for-small-businesses-wordpress-theme-theme-3-1-3-php-object-injection-vulnerability and the Themovation vendor page; upgrade to any release later than 3.1.3 once available. As compensating controls, disable open user registration in WordPress Settings → General (trade-off: blocks self-service signup flows), restrict the Subscriber role from reaching the vulnerable endpoint via a WAF rule or mu-plugin gate, and deploy a virtual patch through Patchstack or Wordfence which can block known object-injection payloads (trade-off: may produce false positives on legitimate serialized cookies/meta). Until patched, consider deactivating the Entrepreneur theme and switching to an unaffected theme if business operations allow.