CVE-2025-62035

Name of the Vulnerable Software and Affected Versions Togo versions prior to 1.0.4

Description The Togo theme for WordPress contains a PHP Object Injection flaw caused by the deserialization of untrusted input. Authenticated attackers with subscriber-level access or higher can inject a PHP Object. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain via other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update Togo to version 1.0.4 or later.