CVE-2025-32572: 
WordPress vulnerability analysis and mitigation

A critical Deserialization of Untrusted Data vulnerability (CVE-2025-32572) was discovered in Climax Themes Kata Plus WordPress plugin. The vulnerability affects versions through 1.5.2 and was disclosed on April 15, 2025. This unauthenticated PHP Object Injection vulnerability allows malicious actors to execute arbitrary code on affected systems (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue is classified as CWE-502 (Deserialization of Untrusted Data) and allows for PHP Object Injection attacks. The vulnerability requires no authentication to exploit and has low attack complexity (NVD).

The vulnerability could allow attackers to execute code injection, SQL injection, path traversal, and denial of service attacks if a proper POP chain is present. Due to its critical severity rating and unauthenticated nature, this vulnerability poses a significant risk to affected websites (Patchstack).

The vulnerability is considered highly dangerous and is expected to become mass exploited. Attackers can exploit this vulnerability without authentication, making it particularly concerning. The automated nature of these attacks means that all websites running vulnerable versions are potential targets (Patchstack).

Currently, no official fix is available for this vulnerability. Patchstack has issued a virtual patch to mitigate the issue by blocking potential attacks until an official fix becomes available. Website administrators are advised to implement these mitigations immediately (Patchstack).