CVE-2025-39588: 
WordPress vulnerability analysis and mitigation

A Deserialization of Untrusted Data vulnerability was discovered in bdthemes Ultimate Store Kit Elementor Addons, affecting versions through 2.4.0. The vulnerability allows Object Injection attacks and was disclosed on April 17, 2025 (NVD, Patchstack).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) and has received a CVSS v3.1 base score of 9.8 CRITICAL (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). This indicates the vulnerability is network-accessible, requires low attack complexity, needs no privileges or user interaction, and can result in high impacts to confidentiality, integrity, and availability (Patchstack).

The vulnerability is highly dangerous and expected to become mass exploited. A malicious actor could potentially execute commands to gain access to the admin panel, cause denial of service, or execute arbitrary code (Patchstack).

Users are advised to update to version 2.4.1 or later to remove the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users have updated to a fixed version (Patchstack).