CVE-2025-68899
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-01-27
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| designthemes | vivagh | to 2.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-68899 is a PHP Object Injection vulnerability in the WordPress Vivagh Theme versions up to 2.4. It allows attackers to inject malicious code by exploiting deserialization of untrusted data, potentially leading to code injection, SQL injection, path traversal, denial of service, and other attacks if a suitable PHP Object Injection POP chain is available. [1]
How can this vulnerability impact me? :
This vulnerability can have severe impacts including unauthorized code execution, database compromise through SQL injection, file system access via path traversal, denial of service attacks, and other malicious activities. It poses a high risk with a CVSS score of 8.8 and can be exploited by users with at least subscriber or developer privileges, potentially compromising the security and availability of affected WordPress sites. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection commands provided for this vulnerability. However, since it is a PHP Object Injection vulnerability affecting the Vivagh WordPress theme up to version 2.4, detection would typically involve monitoring for unusual PHP object injection attempts or suspicious payloads targeting the theme. Patchstack provides mitigation rules that can help block attacks, which may include detection capabilities, but no explicit commands are given. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the Patchstack mitigation rule provided to block attacks targeting this vulnerability until an official patch is released. Users are strongly advised to implement this mitigation immediately to protect their websites. Since no official fix is available yet, using Patchstack's automated vulnerability mitigation and security intelligence is the recommended approach. [1]