CVE-2025-32927: 
WordPress vulnerability analysis and mitigation

A Deserialization of Untrusted Data vulnerability (CVE-2025-32927) was discovered in Chimpstudio FoodBakery WordPress plugin, affecting versions up to 3.3. The vulnerability was initially reported on December 18, 2024, and was publicly disclosed on April 21, 2025. This security flaw allows for Object Injection in the affected software (Patchstack).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (Critical), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The attack vector is Network-based, requires Low attack complexity, needs No privileges, and can be executed without User interaction. The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) (NVD).

The vulnerability could potentially allow malicious actors to execute code injection, SQL injection, path traversal, and denial of service attacks if a proper POP chain is present. The high CVSS score of 9.8 indicates that this vulnerability is highly dangerous and is expected to become mass exploited (Patchstack).

The vulnerability is particularly concerning as it requires no authentication to exploit, making it accessible to unauthenticated attackers. The attack complexity is rated as low, indicating that exploitation is straightforward. Hackers typically automate attacks against such vulnerabilities to compromise as many websites as possible before users have time to patch and update (Patchstack).

Currently, no official fix is available for this vulnerability. However, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until an official fix becomes available. Website administrators are advised to implement mitigation measures immediately (Patchstack).