CVE-2025-69372: WordPress SevenHills theme <= 1.6.2 - PHP Object Injection vulnerability
Published Feb 20, 2026
·Updated
Deserialization of Untrusted Data vulnerability in AncoraThemes SevenHills sevenhills allows Object Injection.This issue affects SevenHills: from n/a through <= 1.6.2.
Affected Software
1 affected component
AncoraThemes SevenHills<=1.6.2
Event History
Feb 20, 2026
CVE Published
via MITRE·03:46 PM
Data Sourced
via MITRE·03:46 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:22 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required. This suggests an unauthenticated remote attacker may be able to exploit a vulnerable installation.
2
Which versions are affected?
SevenHills versions through 1.6.2 are affected. The available data does not identify a fixed version.
3
What is the potential impact?
The vulnerability is rated critical with a CVSS score of 9.8 and can affect confidentiality, integrity, and availability at high impact levels.