CVE-2025-69130

Name of the Vulnerable Software and Affected Versions Entrepreneur - Booking for Small Businesses WordPress Theme versions prior to 3.1.4

Description This issue involves PHP Object Injection caused by the deserialization of untrusted input. Authenticated attackers with subscriber-level access or higher can inject a PHP Object. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the theme itself, the presence of a POP chain via other installed plugins or themes could allow an attacker to execute code, retrieve sensitive data, or delete arbitrary files.

Recommendations Update Entrepreneur - Booking for Small Businesses WordPress Theme to version 3.1.4 or later.