CVE-2025-39356: 
WordPress vulnerability analysis and mitigation

A Deserialization of Untrusted Data vulnerability (CVE-2025-39356) was discovered in Chimpstudio Foodbakery Sticky Cart plugin for WordPress. The vulnerability affects all versions through 3.2 and allows Object Injection. The issue was discovered by security researcher Bonds and was published on April 21, 2025 (Wiz, Patchstack).

The vulnerability is classified as a PHP Object Injection with a CVSS score of 9.8 (Critical). The issue stems from improper handling of untrusted data deserialization in the plugin, which could lead to object injection attacks. The vulnerability can be exploited without authentication, making it particularly dangerous (Wiz, Patchstack).

The vulnerability could allow malicious actors to execute code injection, SQL injection, path traversal, or denial of service attacks if a proper POP chain is present. Due to its high severity score and unauthenticated nature, this vulnerability is expected to become mass exploited (Patchstack).

Currently, there is no official fix available from the vendor. However, Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until an official fix becomes available. Users are advised to implement mitigation measures immediately (Wiz, Patchstack).