PT-2025-13400 · Unknown · Shinetheme Traveler

Rafie Muhammad · Published 2025-03-27 · Updated 2025-06-09 · CVE-2025-26873

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shinetheme Traveler versions 3.1.8 and earlier

Description The issue is related to the deserialization of untrusted data. This is a type of vulnerability where an application receives data from an untrusted source and deserializes it without proper validation, potentially allowing an attacker to execute malicious code.

Recommendations For versions 3.1.8 and earlier, update to a version later than 3.1.8 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-26873

Affected Products

Shinetheme Traveler

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-26873 · Security Note
• https://patchstack.com/database/wordpress/theme/traveler/vulnerability/wordpress-traveler-theme-3-1-8-php-object-injection-vulnerability?_s_id=cve · Note
• https://t.me/cvedetector/21353 · Telegram Post
• https://t.me/cvenotify/125049 · Telegram Post
• https://twitter.com/CVETracker/status/1905711676214915165 · Twitter Post
• https://twitter.com/RedTeamNewsBlog/status/1905551918224536036 · Twitter Post
• https://twitter.com/CveFindCom/status/1905379836824002746 · Twitter Post
• https://t.me/cvetracker/20110 · Telegram Post
• https://twitter.com/CVEnew/status/1905811750131294671 · Twitter Post
• https://patchstack.com/database/Wordpress/Theme/traveler/vulnerability/wordpress-traveler-theme-3-1-8-php-object-injection-vulnerability?_s_id=cve · Note