CVE-2025-69002

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2026-01-22

Last updated on: 2026-01-28

Assigner: Patchstack

Description

Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affects OneLife: from n/a through <= 3.9.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-22

Last Modified

2026-01-28

Generated

2026-07-06

AI Q&A

2026-01-22

EPSS Evaluated

2026-07-05

NVD

CVE-2025-69002

Affected Vendors & Products

Vendor	Product	Version / Range
designthemes	onelife	to 3.9 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

CVE-2025-69002 is a PHP Object Injection vulnerability in the WordPress OneLife Theme (versions up to 3.9). It allows attackers to inject malicious objects through deserialization of untrusted data, potentially enabling code injection, SQL injection, path traversal, denial of service, and other attacks if a suitable PHP Object Injection POP chain is available. [1]

Detection Guidance

There is no specific information provided about detection commands or methods for this vulnerability. However, Patchstack has issued a mitigation rule that can block attacks targeting this vulnerability until an official patch is available. It is recommended to use automated protection solutions from Patchstack to safeguard affected websites. [1]

Impact Analysis

This vulnerability can lead to severe security issues including unauthorized code execution, database compromise via SQL injection, file system access through path traversal, denial of service attacks, and other malicious activities that can disrupt or compromise the affected website or server. [1]

Mitigation Strategies

Immediate mitigation steps include applying the mitigation rule issued by Patchstack that can block attacks targeting this vulnerability until an official patch is released. Patchstack also offers automated protection solutions to safeguard affected websites. Since no official fix is available as of the publication date, using these mitigation measures is recommended to reduce risk. [1]

Hi! I’m here to help you understand CVE-2025-69002. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70