CVE-2025-69002
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2026-01-22

Last updated on: 2026-01-28

Assigner: Patchstack

Description
Deserialization of Untrusted Data vulnerability in designthemes OneLife onelife allows Object Injection.This issue affects OneLife: from n/a through <= 3.9.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-22
Last Modified
2026-01-28
Generated
2026-06-16
AI Q&A
2026-01-22
EPSS Evaluated
2026-06-14
NVD
CVE-2025-69002
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
designthemes onelife to 3.9 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-502 The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Detection Guidance

There is no specific information provided about detection commands or methods for this vulnerability. However, Patchstack has issued a mitigation rule that can block attacks targeting this vulnerability until an official patch is available. It is recommended to use automated protection solutions from Patchstack to safeguard affected websites. [1]

Executive Summary

CVE-2025-69002 is a PHP Object Injection vulnerability in the WordPress OneLife Theme (versions up to 3.9). It allows attackers to inject malicious objects through deserialization of untrusted data, potentially enabling code injection, SQL injection, path traversal, denial of service, and other attacks if a suitable PHP Object Injection POP chain is available. [1]

Impact Analysis

This vulnerability can lead to severe security issues including unauthorized code execution, database compromise via SQL injection, file system access through path traversal, denial of service attacks, and other malicious activities that can disrupt or compromise the affected website or server. [1]

Mitigation Strategies

Immediate mitigation steps include applying the mitigation rule issued by Patchstack that can block attacks targeting this vulnerability until an official patch is released. Patchstack also offers automated protection solutions to safeguard affected websites. Since no official fix is available as of the publication date, using these mitigation measures is recommended to reduce risk. [1]

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-69002. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart