Cyber Posture

CVE-2025-62035

High

Published: 06 November 2025

Published
06 November 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0012 30.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-62035 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the uxper Togo WordPress theme. Published on 2025-11-06, it affects all versions of the Togo theme from n/a through those prior to 1.0.4. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting its high severity due to network accessibility, low complexity, and potential for significant impacts.

An attacker with low privileges, such as an authenticated WordPress user, can exploit this vulnerability remotely without requiring user interaction. Exploitation involves PHP object injection via untrusted deserialization, enabling high confidentiality, integrity, and availability impacts, such as potential remote code execution or data manipulation on the affected site.

The Patchstack advisory details the vulnerability as a PHP object injection issue in the Togo WordPress theme and confirms it was fixed in version 1.0.4. Mitigation requires updating the theme to 1.0.4 or later to prevent exploitation.

Details

CWE(s)
CWE-502

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Deserialization vulnerability in WordPress theme enables remote code execution by low-privilege authenticated users, directly facilitating T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References