Deserialization of Untrusted Data Vulnerability in Finance Consultant by DesignThemes
CVE-2025-32293

8.8HIGH

Key Information:

Vendor

WordPress
Status
Finance Consultant
Vendor
CVE Published:
23 May 2025

What is CVE-2025-32293?

The Finance Consultant theme by DesignThemes is susceptible to a deserialization of untrusted data vulnerability, allowing for Object Injection. This vulnerability could lead to unauthorized access or manipulation of stored data, impacting the integrity of the affected application. Users running versions from n/a through 2.8 should take immediate action to secure their instances from potential exploitation.

Affected Version(s)

Finance Consultant <= 2.8

References

https://patchstack.com/database/wordpress/theme/finance/v...
vdb-entry

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) (Patchstack Alliance)
JSON
.