CVE-2025-58619

Name of the Vulnerable Software and Affected Versions Falang multilanguage versions prior to 1.3.66

Description This issue involves the deserialization of untrusted data, which allows for PHP Object Injection. An unauthenticated attacker can inject a PHP Object into the system. This flaw requires a POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) to be present in another installed plugin or theme to have a significant impact. If such a chain exists, it could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update to a version newer than 1.3.65.