Object Injection Vulnerability in ThemeREX Extreme Store Plugin
CVE-2025-69404

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Extreme Store
Vendor
CVE Published:
20 February 2026

What is CVE-2025-69404?

The ThemeREX Extreme Store plugin for WordPress is susceptible to a deserialization of untrusted data vulnerability that permits an attacker to exploit object injection. This flaw, present in versions up to 1.5.7, can lead to unauthorized actions on the server, potentially compromising sensitive information and undermining site integrity. Users are encouraged to review their plugin versions and take immediate action to ensure security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Extreme Store <= n/a

References

https://patchstack.com/database/Wordpress/Theme/extremest...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program
JSON
.