CVE-2025-47579 CRITICAL

CVE-2025-47579: WordPress Photography Theme <= 7.7.2 - PHP Object Injection Vulnerability

Vendor Themegoods
Product Photography
Weakness CWE-502 · Unsafe deserialization
Published September 9, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

9.0/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in ThemeGoods Photography photography allows Object Injection.This issue affects Photography: from n/a through <= 7.7.2.

Explanation of Vulnerability in Simple Terms

02Summary

ThemeGoods Photography versions up to 7.7.2 contain a deserialization vulnerability that allows unauthenticated attackers to execute arbitrary code on the site. The vulnerability requires specific network conditions but can compromise the entire server, including data confidentiality, integrity, and availability. Site administrators should update immediately to a patched version.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the site server without authentication, potentially compromising all data and functionality.

Potential impact on your site

04Site Impact

Complete server compromise possible: attackers can read/modify all data, install backdoors, or take the site offline.

Conditions required to exploit

05Prerequisites

Network access to the site; no authentication or user interaction required, though exploitation requires specific network conditions.

Key dates

06Disclosure timeline

September 9, 2025 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-7637 Boost <= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_LOCATION Cookie CVE-2026-49109 WordPress Integration for Salesforce and Contact Form 7, WPForms, Elementor, Formidable, Ninja Forms plugin <= 1.4.3 - PHP Object Injection vulnerability CVE-2026-42687 WordPress EventPrime plugin <= 4.3.2.1 - PHP Object Injection vulnerability CVE-2026-3296 Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata CVE-2026-56037 WordPress Themify Popup plugin <= 1.4.3 - PHP Object Injection vulnerability