CVE-2025-69404: WordPress Extreme Store theme <= 1.5.10 - PHP Object Injection vulnerability
Published Feb 20, 2026
·Updated
Deserialization of Untrusted Data vulnerability in ThemeREX Extreme Store extremestore allows Object Injection.This issue affects Extreme Store: from n/a through <= 1.5.10.
Affected Software
1 affected component
ThemeREX Extreme Store (WordPress theme)<=1.5.10
Event History
Feb 20, 2026
CVE Published
via MITRE·03:46 PM
Data Sourced
via MITRE·03:46 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:22 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an authenticated WordPress account or user interaction?
No. The CVSS vector indicates no privileges are required and no user interaction is needed. It is rated network-accessible with low attack complexity.
2
Which installations should be considered affected?
ThemeREX Extreme Store installations running version 1.5.10 or earlier should be considered affected. The affected version range is listed as through 1.5.10.
3
What is the potential impact if this is exploited?
The CVSS rating is 9.8 critical, with high impacts to confidentiality, integrity, and availability. The vulnerability is categorized as PHP object injection through deserialization of untrusted data.