CVE-2025-31052CWE-502

WordPress The Fashion - Model Agency One Page Beauty Theme plugin <= 1.4.4 - Deserialization of untrusted data Vulnerability

Critical · published June 9, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
46.6
In the wild
Unconfirmed
What it is

🚨 A crafty object injection vulnerability is lurking in The Fashion - Model Agency theme, and it could turn your stylish site into a nightmare! 🔥 Think of it like a fashion designer who accepts any fabric sent their way without checking if it’s suitable — that piece could end up ruining the whole collection! This vulnerability lets attackers inject untrusted data, potentially altering site functionality. With this vulnerability, an attacker could execute arbitrary code on your server, paving the way for data leaks or complete site takeover. It’s like a thief walking into your boutique and rearranging everything without anyone noticing! You absolutely need to take action to prevent this potentially devastating scenario.

Put simply

Think of it like a fashion designer who accepts any fabric sent their way without checking if it’s suitable — that piece could end up ruining the whole collection! This vulnerability lets attackers inject untrusted data, potentially altering site functionality. The deserialization of untrusted data flaw allows an attacker to exploit The Fashion - Model Agency theme by injecting malicious objects into the system. This can lead to unauthorized access and manipulation of the application.

What to do

With this vulnerability, an attacker could execute arbitrary code on your server, paving the way for data leaks or complete site takeover. It’s like a thief walking into your boutique and rearranging everything without anyone noticing! You absolutely need to take action to prevent this potentially devastating scenario. To fix this issue, immediately update your theme to version 1.4.5 or later. Additionally, implement strict data validation and sanitation measures to guard against similar attacks in the future. Don't panic! By taking these steps, you’ll secure your site and keep your fashion empire safe! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00573 · 46.6th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2025-06-09T15:56Z
EPSS history
Timeline
  • 09 JUN 15:56Z
    WordPress The Fashion - Model Agency One Page Beauty Theme plugin <= 1.4.4 - Deserialization of untrusted data Vulnerability
    cvelistv5