CVE-2025-53242

Name of the Vulnerable Software and Affected Versions VictorThemes Seil versions prior to 1.7.2

Description This issue involves the deserialization of untrusted data, which allows for PHP Object Injection. An unauthenticated attacker can inject a PHP Object into the system. While no POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) is present in the software itself, the issue can be exploited if another plugin or theme containing a POP chain is installed. Depending on the available chain, this could lead to the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update VictorThemes Seil to version 1.7.2 or later.