CVE-2025-32145: 
WordPress vulnerability analysis and mitigation

A Deserialization of Untrusted Data vulnerability was discovered in magepeopleteam WpEvently plugin affecting versions through 4.3.5. The vulnerability was assigned CVE-2025-32145 and was disclosed on April 10, 2025 (NVD, Patchstack).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) and received a CVSS v3.1 score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability requires low attack complexity and can be exploited remotely with low privileges and no user interaction (NVD).

The vulnerability could allow an attacker to perform code injection, SQL injection, path traversal, or denial of service attacks if a proper POP chain is present in the system. The high CVSS score indicates potential for significant impact on the confidentiality, integrity, and availability of the affected system (Patchstack).

Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until an official fix becomes available. No official fix has been released yet for versions beyond 4.3.5 (Patchstack).