CVE-2025-58839
BaseFortify
Publication date: 2025-09-05
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| themeart | eds_responsive_menu | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a PHP Object Injection issue in the eDS Responsive Menu WordPress plugin (versions up to 1.2). It allows a malicious actor with administrator privileges to inject malicious objects, potentially leading to attacks such as code injection, SQL injection, path traversal, and denial of service. The vulnerability is related to deserialization of untrusted data and falls under the OWASP Top 10 category A3: Injection. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can lead to severe impacts including unauthorized code execution, database compromise via SQL injection, unauthorized file system access through path traversal, and denial of service conditions. These impacts can compromise the confidentiality, integrity, and availability of your system. Exploitation requires administrator privileges, but the risks remain significant due to the range of possible attacks. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying the presence of the vulnerable eDS Responsive Menu plugin version 1.2 or earlier on your WordPress installation. Since the vulnerability requires administrator privileges to exploit, monitoring for unusual administrator activity or unexpected PHP object injection attempts in logs may help. However, no specific detection commands are provided. It is recommended to perform server-side malware scanning and professional incident response if compromise is suspected. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include replacing the vulnerable eDS Responsive Menu plugin with an alternative solution, as the plugin is abandoned and no official fix is available. Simply deactivating the plugin does not fully eliminate the risk unless a virtual patch (vPatch) is applied. Patchstack offers virtual patching to mitigate this vulnerability in the absence of an official fix. Additionally, professional incident response and server-side malware scanning are recommended if compromise is suspected. [1]