EUVD-2025-18547Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in themeton Spare allows Object Injection. This issue affects Spare: from n/a through 1.7.
AnalysisAI
PHP object injection in Spare WordPress theme versions up to 1.7 enables remote unauthenticated attackers to execute arbitrary code through deserialization of untrusted data. The CVSS 9.8 critical rating reflects network-accessible exploitation requiring no authentication or user interaction, with complete system compromise possible. EPSS score of 0.14% (34th percentile) suggests low observed exploitation probability despite critical severity, and no CISA KEV listing confirms no widespread active exploitation detected. Patchstack vulnerability database identifies this as a PHP object injection vulnerability in the WordPress theme marketplace.
Technical ContextAI
This is a CWE-502 deserialization vulnerability affecting the Spare WordPress theme by themeton. PHP object injection occurs when untrusted serialized data is passed to PHP's unserialize() function without proper validation, allowing attackers to instantiate arbitrary objects and potentially trigger magic methods (__wakeup, __destruct, __toString) that execute attacker-controlled code. WordPress themes often deserialize user-supplied data from cookies, POST parameters, or database values for session management or configuration storage. The vulnerability's AV:N vector indicates the deserialization endpoint is accessible over the network, likely through theme-specific AJAX handlers or form processors that accept serialized PHP objects without sanitization. Successful exploitation depends on the presence of suitable PHP gadget chains within the WordPress environment (core, plugins, or theme code) that can be chained to achieve code execution, file manipulation, or SQL injection.
RemediationAI
Consult the Patchstack advisory at https://patchstack.com/database/wordpress/theme/spare/vulnerability/wordpress-spare-1-7-php-object-injection-vulnerability for vendor-confirmed remediation steps. Fixed version number not confirmed in available data - organizations must verify with themeton or Patchstack whether version 1.8 or later addresses this vulnerability. If no patched version exists, implement compensating controls: (1) Replace Spare theme with an alternative maintained theme - side effect requires redesigning site appearance and may break custom functionality; (2) Deploy web application firewall rules to block serialized PHP objects in HTTP requests (inspect POST/GET parameters and cookies for patterns like 'O:' followed by digits) - may cause false positives blocking legitimate WordPress operations; (3) Restrict wp-admin and theme file access to trusted IP addresses via .htaccess or firewall rules - limits administrative flexibility for remote teams. Monitor WordPress security logs for unusual unserialize() calls or unexpected object instantiation. Verify theme is actively maintained before deploying in production environments.
Share
External POC / Exploit Code
Leaving vuln.today