CVE-2025-47584
BaseFortify
Publication date: 2025-06-06
Last updated on: 2026-01-22
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| themegoods | photography | to 7.7.2 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-47584 is a PHP Object Injection vulnerability in the WordPress Photography theme up to version 7.5.2. It allows a malicious user with subscriber-level privileges to inject malicious PHP objects, which can lead to various attacks such as code injection, SQL injection, path traversal, and denial of service. This vulnerability is severe, with a CVSS score of 8.5, and is classified under OWASP Top 10 A3: Injection. [1]
How can this vulnerability impact me? :
This vulnerability can have serious impacts including unauthorized code execution, database compromise through SQL injection, unauthorized file system access via path traversal, and denial of service attacks. Attackers with low-level privileges can exploit this flaw to escalate their access and potentially take control of the affected website, leading to data breaches, service disruption, and loss of trust. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands provided. However, since the vulnerability involves PHP Object Injection in the WordPress Photography theme up to version 7.5.2, monitoring for unusual PHP object injection attempts or suspicious subscriber-level activities could help. Patchstack notes that plugin-based malware scanners are often unreliable against such threats, so professional incident response services are recommended for detection and analysis. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves applying the Patchstack virtual patch (vPatch) which automatically blocks attack attempts targeting this vulnerability until an official fix is released. Users should apply this virtual patch promptly to protect affected sites. Additionally, seeking professional incident response services is advised if compromise is suspected. [1]