CVE-2025-54719
Published: 06 November 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-54719 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the NooTheme Yogi - Health Beauty & Yoga WordPress theme (noo-yogi), which allows Object Injection. The issue affects all versions of the theme from n/a through 2.9.2 and was published on 2025-11-06.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited remotely over the network with low complexity by low-privileged users, without requiring user interaction and without changing scope. Attackers with low privileges, such as authenticated contributors, can leverage object injection to achieve high impacts on confidentiality, integrity, and availability, potentially leading to severe compromise of the affected WordPress site.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/noo-yogi/vulnerability/wordpress-yogi-health-beauty-yoga-theme-2-9-2-deserialization-of-untrusted-data-vulnerability?_s_id=cve details the vulnerability in the context of the WordPress theme.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Deserialization of untrusted data (CWE-502) in a public-facing WordPress theme enables remote code execution via object injection, directly mapping to exploitation of public-facing applications.