Description
Deserialization of Untrusted Data vulnerability in bulktheme WOOEXIM wooexim allows Object Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0.
Published: 2025-01-22
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability is a Deserialization of Untrusted Data flaw that permits PHP Object Injection in bulktheme's WOOEXIM WordPress plugin. By manipulating the data that the plugin processes during its import/export operations, an attacker can construct crafted serialized objects that are instantiated on the server. If successfully executed, this attack can lead to arbitrary code execution or other destructive actions on the affected WordPress site, compromising confidentiality, integrity, and availability.

Affected Systems

The flaw affects the bulktheme WOOEXIM WordPress plugin, versions n/a through 5.0.0. Any WordPress installation that has one of these plugin versions enabled is vulnerable.

Risk and Exploitability

The CVSS score of 8.8 classifies the vulnerability as high severity. The EPSS score of less than 1% indicates a low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be through the plugin’s import/export functionality, which may be accessible to authenticated users or potentially unauthenticated users depending on the site configuration.

Generated by OpenCVE AI on May 1, 2026 at 19:28 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the WOOEXIM plugin to the latest version (>=5.0.1) where the deserialization issue has been fixed.
  • If an upgrade is not immediately possible, deactivate or uninstall the WOOEXIM plugin to eliminate the attack surface.
  • Validate that the plugin’s import/export interfaces are not exposed to untrusted parties and restrict access to trusted users only.

Generated by OpenCVE AI on May 1, 2026 at 19:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-3558 Deserialization of Untrusted Data vulnerability in WOOEXIM.COM WOOEXIM allows Object Injection. This issue affects WOOEXIM: from n/a through 5.0.0.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Deserialization of Untrusted Data vulnerability in WOOEXIM.COM WOOEXIM allows Object Injection. This issue affects WOOEXIM: from n/a through 5.0.0. Deserialization of Untrusted Data vulnerability in bulktheme WOOEXIM wooexim allows Object Injection.This issue affects WOOEXIM: from n/a through <= 5.0.0.
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Wed, 22 Jan 2025 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 22 Jan 2025 14:45:00 +0000

Type Values Removed Values Added
Description Deserialization of Untrusted Data vulnerability in WOOEXIM.COM WOOEXIM allows Object Injection. This issue affects WOOEXIM: from n/a through 5.0.0.
Title WordPress WOOEXIM Plugin <= 5.0.0 - PHP Object Injection vulnerability
Weaknesses CWE-502
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:11:25.661Z

Reserved: 2025-01-16T11:32:45.573Z

Link: CVE-2025-23944

cve-icon Vulnrichment

Updated: 2025-01-22T15:25:27.133Z

cve-icon NVD

Status : Deferred

Published: 2025-01-22T15:15:26.240

Modified: 2026-04-23T15:24:49.873

Link: CVE-2025-23944

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T19:30:23Z

Weaknesses