CVE-2025-31634
Published: 22 October 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-31634 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Insurance WordPress theme developed by designthemes. It enables Object Injection and affects all versions of the theme up to and including 3.5. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.
An attacker with low privileges, such as an authenticated WordPress user, can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By supplying untrusted data for deserialization, the attacker can trigger Object Injection, potentially leading to high-impact outcomes including unauthorized data access, modification, or disruption of system availability.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/insurance/vulnerability/wordpress-insurance-3-5-php-object-injection-vulnerability?_s_id=cve documents this PHP Object Injection issue in Insurance theme version 3.5 and provides details relevant to mitigation for affected WordPress installations.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Deserialization of Untrusted Data (Object Injection) in a WordPress theme, a public-facing web application, directly enables remote exploitation by low-privileged authenticated users to achieve high confidentiality, integrity, and availability impacts.