PT-2026-21122 · Fuelthemes · Peakshops

Published 2026-02-20 · Updated 2026-02-22 · CVE-2025-69294

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions fuelthemes PeakShops versions through 1.5.9

Description A flaw exists in fuelthemes PeakShops that allows for object injection due to deserialization of untrusted data. This condition can be exploited by attackers.

Recommendations Versions prior to 1.5.9 should be updated.

Fix

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-69294

Affected Products

Peakshops

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-69294 · Security Note
• https://twitter.com/CVEnew/status/2025425524227780982 · Twitter Post
• https://patchstack.com/database/Wordpress/Theme/peakshops/vulnerability/wordpress-peakshops-theme-1-5-9-php-object-injection-vulnerability?_s_id=cve · Note