CVE-2025-53586

Name of the Vulnerable Software and Affected Versions NooTheme WeMusic versions prior to 1.9.2

Description An issue exists where the software allows the deserialization of untrusted data, leading to PHP Object Injection. Authenticated attackers with subscriber-level access or higher can inject a PHP Object. While no native POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) is present in the software, the presence of a POP chain via other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update NooTheme WeMusic to version 1.9.2 or later.