PT-2026-26268 · Unknown · Themeton Zuut

Published 2026-03-19 · Updated 2026-03-23 · CVE-2025-60233

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Themeton Zuut versions through 1.4.2

Description The software contains a flaw due to deserialization of untrusted data, which can lead to object injection. This allows for potential remote code execution. The vulnerability exists in the way the software handles serialized data, potentially allowing an attacker to inject malicious objects.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-60233

Affected Products

Themeton Zuut

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-60233 · Security Note
• https://twitter.com/CVEnew/status/2036024232602386626 · Twitter Post
• https://patchstack.com/database/Wordpress/Theme/zuut/vulnerability/wordpress-zuut-theme-1-4-2-php-object-injection-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/theme/zuut/vulnerability/wordpress-zuut-theme-1-4-2-php-object-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/CveFindCom/status/2034566217868951848 · Twitter Post
• https://twitter.com/0dayPublishing/status/2034629514542637432 · Twitter Post