CVE-2025-69111 - Vulnerability Details

Description

Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.

Published: 2026-06-17

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An unauthenticated PHP Object Injection flaw allows an attacker to manipulate serialized data that the Reisen theme processes. This vulnerability can lead to arbitrary code execution on the web server, enabling full compromise of the site, theft of data, or further propagation of malware. The weakness is identified as CWE-502.

Affected Systems

ThemeREX Reisen theme versions 1.4.1 and earlier are vulnerable. The issue exists in all releases of Reisen up to and including 1.4.1.

Risk and Exploitability

The flaw carries a CVSS score of 9.8, indicating critical severity. EPSS data is not available, but the absence of mitigation means potential exploitation is high. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves a remote web request that passes crafted serialized input to the theme, which is then unserialized without proper validation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

ThemeREX

Reisen

unaffected

Version	Status	Constraints
`n/a`	affected	≤ 1.4.1

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Reisen theme to version 1.4.2 or newer, removing the insecure unserialize usage.
If an immediate update is not possible, disable or uninstall the Reisen theme to eliminate the attack surface.
Inspect any custom code or third‑party plugins that may perform uncontrolled unserialization of user-supplied data, ensuring proper validation or using safe deserialization functions.

Generated by OpenCVE AI on June 18, 2026 at 13:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00386.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://patchstack.com/database/wordpress/theme/reisen/vulnerability/wordpress-reisen-theme-1-4-1-php-object-injection-vulnerability?_s_id=cve

History

Thu, 18 Jun 2026 04:45:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 17 Jun 2026 14:00:00 +0000

Type	Values Removed	Values Added
Description		Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.
Title		WordPress Reisen theme <= 1.4.1 - PHP Object Injection vulnerability
Weaknesses		CWE-502
References		https://patchstack.com/database/wordpress/theme/reisen/vulnerability/wordpress-reisen-theme-1-4-1-php-object-injection-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Subscriptions

No data.

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2026-06-17T12:47:20.925Z

Updated: 2026-06-17T14:33:09.784Z

Reserved: 2025-12-29T11:19:26.264Z

Link: CVE-2025-69111

Vulnrichment

Updated: 2026-06-17T14:33:07.025Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-06-18T14:00:16Z

Weaknesses

CWE-502
Deserialization of Untrusted Data

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-69111", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-12-29T11:19:26.264Z", "datePublished": "2026-06-17T12:47:20.925Z", "dateUpdated": "2026-06-17T14:33:09.784Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-06-17T12:47:20.925Z"}, "title": "WordPress Reisen theme <= 1.4.1 - PHP Object Injection vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "CAPEC-586 Object Injection"}]}], "affected": [{"vendor": "ThemeREX", "collectionURL": "https://wordpress.org/themes", "defaultStatus": "unaffected", "packageName": "reisen", "product": "Reisen", "versions": [{"lessThanOrEqual": "1.4.1", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions."}], "value": "Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions."}], "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/theme/reisen/vulnerability/wordpress-reisen-theme-1-4-1-php-object-injection-vulnerability?_s_id=cve"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-17T14:33:00.670673Z", "id": "CVE-2025-69111", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-17T14:33:09.784Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-69111", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-12-29T11:19:26.264Z", "datePublished": "2026-06-17T12:47:20.925Z", "dateUpdated": "2026-06-17T14:33:09.784Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-06-17T12:47:20.925Z"}, "title": "WordPress Reisen theme <= 1.4.1 - PHP Object Injection vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-586", "descriptions": [{"lang": "en", "value": "CAPEC-586 Object Injection"}]}], "affected": [{"vendor": "ThemeREX", "collectionURL": "https://wordpress.org/themes", "defaultStatus": "unaffected", "packageName": "reisen", "product": "Reisen", "versions": [{"lessThanOrEqual": "1.4.1", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions."}], "value": "Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions."}], "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/theme/reisen/vulnerability/wordpress-reisen-theme-1-4-1-php-object-injection-vulnerability?_s_id=cve"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) | Patchstack Bug Bounty Program"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-69111", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-17T14:33:00.670673Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-17T14:33:07.025Z"}}]}}

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object