CVE-2025-62035
Published: 06 November 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-62035 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the uxper Togo WordPress theme. Published on 2025-11-06, it affects all versions of the Togo theme from n/a through those prior to 1.0.4. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting its high severity due to network accessibility, low complexity, and potential for significant impacts.
An attacker with low privileges, such as an authenticated WordPress user, can exploit this vulnerability remotely without requiring user interaction. Exploitation involves PHP object injection via untrusted deserialization, enabling high confidentiality, integrity, and availability impacts, such as potential remote code execution or data manipulation on the affected site.
The Patchstack advisory details the vulnerability as a PHP object injection issue in the Togo WordPress theme and confirms it was fixed in version 1.0.4. Mitigation requires updating the theme to 1.0.4 or later to prevent exploitation.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Deserialization vulnerability in WordPress theme enables remote code execution by low-privilege authenticated users, directly facilitating T1190: Exploit Public-Facing Application.