CVE-2025-54719

Name of the Vulnerable Software and Affected Versions NooTheme Yogi - Health Beauty & Yoga versions prior to 2.9.3

Description This issue involves the deserialization of untrusted data, which allows for PHP Object Injection. Authenticated attackers with Subscriber-level access and above can inject a PHP Object. This flaw requires a POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) from another installed plugin or theme to be exploitable. If such a chain exists, it could lead to the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update NooTheme Yogi - Health Beauty & Yoga to a version newer than 2.9.2.