CVE-2025-69002
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-01-28
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| designthemes | onelife | to 3.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-69002 is a PHP Object Injection vulnerability in the WordPress OneLife Theme (versions up to 3.9). It allows attackers to inject malicious objects through deserialization of untrusted data, potentially enabling code injection, SQL injection, path traversal, denial of service, and other attacks if a suitable PHP Object Injection POP chain is available. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided about detection commands or methods for this vulnerability. However, Patchstack has issued a mitigation rule that can block attacks targeting this vulnerability until an official patch is available. It is recommended to use automated protection solutions from Patchstack to safeguard affected websites. [1]
How can this vulnerability impact me? :
This vulnerability can lead to severe security issues including unauthorized code execution, database compromise via SQL injection, file system access through path traversal, denial of service attacks, and other malicious activities that can disrupt or compromise the affected website or server. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the mitigation rule issued by Patchstack that can block attacks targeting this vulnerability until an official patch is released. Patchstack also offers automated protection solutions to safeguard affected websites. Since no official fix is available as of the publication date, using these mitigation measures is recommended to reduce risk. [1]