CVE-2025-68531
Deserialization Vulnerability in ModelTheme Addons Enables Object Injection
Publication date: 2026-02-20
Last updated on: 2026-02-24
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| modeltheme | modeltheme_addons_for_wpbakery | to 1.5.6 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-68531 is a PHP Object Injection vulnerability found in the WordPress ModelTheme Addons for WPBakery and Elementor Plugin versions prior to 1.5.6.
This vulnerability allows a malicious actor with at least contributor or developer privileges to inject PHP objects, potentially leading to code injection, SQL injection, path traversal, denial of service, and other attacks if a suitable Property Oriented Programming (POP) chain is available.
It is classified under the OWASP Top 10 category A3: Injection.
How can this vulnerability impact me? :
Exploitation of this vulnerability can lead to serious security impacts including:
- Code injection allowing execution of arbitrary code.
- SQL injection which can compromise the database.
- Path traversal attacks potentially exposing sensitive files.
- Denial of service attacks disrupting the availability of the application.
These impacts can compromise the integrity, confidentiality, and availability of your WordPress site using the affected plugin.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects WordPress ModelTheme Addons for WPBakery and Elementor Plugin versions prior to 1.5.6. Detection involves identifying if the vulnerable plugin version is installed.
Since exploitation requires contributor or developer privileges and involves PHP Object Injection, monitoring for unusual PHP object deserialization or suspicious requests targeting the plugin endpoints may help detect exploitation attempts.
Patchstack has issued mitigation rules to block attacks targeting this vulnerability, which can be used as detection mechanisms.
Specific commands are not provided in the resources, but general detection steps include:
- Check the installed version of the ModelTheme Addons for WPBakery and Elementor plugin to see if it is below 1.5.6.
- Use WordPress CLI or plugin management commands to list plugin versions, e.g., `wp plugin list`.
- Monitor web server logs for suspicious requests that may indicate PHP Object Injection attempts.
What immediate steps should I take to mitigate this vulnerability?
[{'type': 'paragraph', 'content': 'The primary and immediate mitigation step is to update the ModelTheme Addons for WPBakery and Elementor Plugin to version 1.5.6 or later, where the vulnerability is patched.'}, {'type': 'paragraph', 'content': 'Until the update can be applied, users are advised to implement Patchstack mitigation rules which block attacks targeting this vulnerability.'}, {'type': 'paragraph', 'content': "Additionally, enabling Patchstack's automatic mitigation and auto-update features can enhance protection against exploitation."}] [1]