PT-2026-26269 · Unknown · Themeton Finag

Published 2026-03-19 · Updated 2026-03-23 · CVE-2025-60237

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Themeton Finag versions through 1.5.0

Description An issue exists in Themeton Finag where deserialization of untrusted data can lead to object injection. This allows for potential exploitation through the deserialization process.

Recommendations Update Finag to a version newer than 1.5.0.

Fix

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2025-60237

Affected Products

Themeton Finag

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-60237 · Security Note
• https://twitter.com/CveFindCom/status/2034566234818183327 · Twitter Post
• https://twitter.com/CVEnew/status/2036024231675507146 · Twitter Post
• https://patchstack.com/database/wordpress/theme/finag/vulnerability/wordpress-finag-theme-1-5-0-php-object-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/0dayPublishing/status/2034652158595928429 · Twitter Post
• https://patchstack.com/database/Wordpress/Theme/finag/vulnerability/wordpress-finag-theme-1-5-0-php-object-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/VulmonFeeds/status/2034621421674999908 · Twitter Post