CVE-2025-67617
Published: 22 January 2026
Summary
CVE-2025-67617 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 18.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the deserialization flaw in the Consult Aid WordPress theme versions through <=1.4.3, preventing object injection exploitation as advised by Patchstack.
Enforces validation of untrusted data inputs to block malicious deserialization payloads that enable PHP object injection in the vulnerable theme.
Restricts input types, formats, and volumes at system boundaries to mitigate acceptance of crafted data triggering the deserialization vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated RCE via deserialization/object injection in public-facing WordPress theme matches T1190 Exploit Public-Facing Application.
NVD Description
Deserialization of Untrusted Data vulnerability in themeton Consult Aid consultaid allows Object Injection.This issue affects Consult Aid: from n/a through <= 1.4.3.
Deeper analysisAI
CVE-2025-67617 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Consult Aid WordPress theme developed by themeton, enabling Object Injection. This issue affects all versions of the Consult Aid theme from its initial release through version 1.4.3.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), making it exploitable over the network by unauthenticated attackers requiring low complexity and no user interaction. Attackers can achieve high impacts on confidentiality, integrity, and availability, potentially leading to severe outcomes such as arbitrary code execution through injected PHP objects.
Mitigation guidance is available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/consultaid/vulnerability/wordpress-consult-aid-theme-1-4-3-php-object-injection-vulnerability?_s_id=cve.
Details
- CWE(s)