CVE-2025-67617

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2026-01-22

Last updated on: 2026-01-29

Assigner: Patchstack

Description

Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-22

Last Modified

2026-01-29

Generated

2026-07-06

AI Q&A

2026-01-22

EPSS Evaluated

2026-07-05

NVD

CVE-2025-67617

Affected Vendors & Products

Vendor	Product	Version / Range
patchstack	consult_aid	From 1.0.0 (inc) to 1.4.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

CVE-2025-67617 is a high-severity PHP Object Injection vulnerability in the WordPress Consult Aid Theme (versions up to 1.4.3). It allows unauthenticated attackers to inject malicious PHP objects, potentially leading to code injection, SQL injection, path traversal, denial of service, and other attacks if a suitable Property Oriented Programming (POP) chain is present. [1]

Impact Analysis

This vulnerability can have critical impacts including unauthorized code execution, database compromise through SQL injection, unauthorized file system access via path traversal, denial of service, and other severe attacks. Since it requires no authentication, attackers can exploit it remotely, potentially leading to full site compromise. [1]

Detection Guidance

Detection can involve monitoring for exploitation attempts targeting the Consult Aid WordPress theme version 1.4.3 or below, especially looking for unusual PHP object injection payloads in HTTP requests. Specific commands are not provided in the available resources. However, users should monitor web server logs for suspicious POST or GET requests containing serialized PHP objects or unusual parameters that could indicate an injection attempt. [1]

Mitigation Strategies

Apply the mitigation rule issued by Patchstack immediately to block attacks targeting this vulnerability until an official patch is released. Users are strongly advised to implement this mitigation to protect their websites running the Consult Aid WordPress theme version 1.4.3 or below. [1]

Hi! I’m here to help you understand CVE-2025-67617. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70