Object Injection Vulnerability in ThemeGoods Grand Restaurant WordPress Product
CVE-2025-39348

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Grand Restaurant WordPress
Vendor
CVE Published:
19 May 2025

What is CVE-2025-39348?

A vulnerability in the ThemeGoods Grand Restaurant WordPress theme allows for Object Injection due to deserialization of untrusted data. This flaw can be exploited by attackers to manipulate data flows, potentially leading to unauthorized access and manipulation of WordPress installations. It is crucial for users of the Grand Restaurant theme to ensure they are running the latest version and to implement security best practices to mitigate potential risks.

Affected Version(s)

Grand Restaurant WordPress <= 7.0

References

https://patchstack.com/database/wordpress/theme/grandrest...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ananda Dhakal (Patchstack)
.
CVE-2025-39348 : Object Injection Vulnerability in ThemeGoods Grand Restaurant WordPress Product