Cyber Resilience

CVE-2025-31634

HighRCE

Published: 22 October 2025

Published
22 October 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0017 38.7th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-31634 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 38.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-31634 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Insurance WordPress theme developed by designthemes. It enables Object Injection and affects all versions of the theme up to and including 3.5. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.

An attacker with low privileges, such as an authenticated WordPress user, can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By supplying untrusted data for deserialization, the attacker can trigger Object Injection, potentially leading to high-impact outcomes including unauthorized data access, modification, or disruption of system availability.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/insurance/vulnerability/wordpress-insurance-3-5-php-object-injection-vulnerability?_s_id=cve documents this PHP Object Injection issue in Insurance theme version 3.5 and provides details relevant to mitigation for affected WordPress installations.

EU & UK References

Vulnerability details

Deserialization of Untrusted Data vulnerability in designthemes Insurance insurance allows Object Injection.This issue affects Insurance: from n/a through <= 3.5.

CWE(s)
CWE-502

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Deserialization of Untrusted Data (Object Injection) in a WordPress theme, a public-facing web application, directly enables remote exploitation by low-privileged authenticated users to achieve high confidentiality, integrity, and availability impacts.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-13770Shared CWE-502
CVE-2026-27303Shared CWE-502
CVE-2025-53586Shared CWE-502
CVE-2025-64353Shared CWE-502
CVE-2025-31047Shared CWE-502
CVE-2026-27096Shared CWE-502
CVE-2023-49886Shared CWE-502
CVE-2026-23542Shared CWE-502
CVE-2025-66631Shared CWE-502
CVE-2026-40044Shared CWE-502

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the deserialization of untrusted data vulnerability by applying patches to the affected Insurance WordPress theme versions up to 3.5.

SI-10 Information Input Validation good match
prevent

Validates untrusted input data prior to deserialization to prevent object injection exploits in the Insurance theme.

SI-9 Information Input Restrictions good match
prevent

Restricts information inputs to authorized types and formats, blocking untrusted serialized data that could lead to object injection.

References