CVE-2025-67617
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-01-29
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | consult_aid | From 1.0.0 (inc) to 1.4.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-67617 is a high-severity PHP Object Injection vulnerability in the WordPress Consult Aid Theme (versions up to 1.4.3). It allows unauthenticated attackers to inject malicious PHP objects, potentially leading to code injection, SQL injection, path traversal, denial of service, and other attacks if a suitable Property Oriented Programming (POP) chain is present. [1]
How can this vulnerability impact me? :
This vulnerability can have critical impacts including unauthorized code execution, database compromise through SQL injection, unauthorized file system access via path traversal, denial of service, and other severe attacks. Since it requires no authentication, attackers can exploit it remotely, potentially leading to full site compromise. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve monitoring for exploitation attempts targeting the Consult Aid WordPress theme version 1.4.3 or below, especially looking for unusual PHP object injection payloads in HTTP requests. Specific commands are not provided in the available resources. However, users should monitor web server logs for suspicious POST or GET requests containing serialized PHP objects or unusual parameters that could indicate an injection attempt. [1]
What immediate steps should I take to mitigate this vulnerability?
Apply the mitigation rule issued by Patchstack immediately to block attacks targeting this vulnerability until an official patch is released. Users are strongly advised to implement this mitigation to protect their websites running the Consult Aid WordPress theme version 1.4.3 or below. [1]