CVE-2025-62035 HIGH

CVE-2025-62035: WordPress Togo theme < 1.0.4 - PHP Object Injection vulnerability

Vendor Uxper
Product Togo
Weakness CWE-502 · Unsafe deserialization
Published November 6, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in uxper Togo togo.This issue affects Togo: from n/a through < 1.0.4.

Explanation of Vulnerability in Simple Terms

02Summary

Togo versions 1.0.4 and earlier contain a deserialization vulnerability that allows authenticated users to execute arbitrary code on the server. An attacker with low-level access can craft malicious serialized data to trigger code execution during deserialization. This affects confidentiality, integrity, and availability of the affected system.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the server with the privileges of the web application.

Potential impact on your site

04Site Impact

A compromised user account can lead to full server compromise, data theft, and site defacement.

Conditions required to exploit

05Prerequisites

Attacker must have a valid user account with low-level privileges and network access to the application.

Key dates

06Disclosure timeline

November 6, 2025 CVE published
April 28, 2026 Record updated