CVE-2025-49455
BaseFortify
Publication date: 2025-06-10
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-89 | The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data. |
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-49455 is a high-severity PHP Object Injection vulnerability in the WordPress TinySalt theme versions before 3.10.0. It allows unauthenticated attackers to inject malicious PHP objects through deserialization of untrusted data. This can lead to various attacks such as code injection, SQL injection, path traversal, denial of service, and other impacts depending on the presence of a suitable Property Oriented Programming (POP) chain. [1]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized code execution, database compromise via SQL injection, unauthorized file system access through path traversal, and denial of service conditions. These impacts can lead to complete compromise of the affected website or server running the vulnerable TinySalt theme. [1]
What immediate steps should I take to mitigate this vulnerability?
Users should immediately update the TinySalt WordPress theme to version 3.10.0 or later, where the vulnerability is fixed. Until the update can be applied, Patchstack offers a virtual patch (vPatch) that automatically mitigates attacks targeting this vulnerability. Timely patching or applying the virtual patch are the recommended immediate mitigation steps. [1]