CVE-2025-9191

CVE-2025-9191 describes a PHP Object Injection vulnerability in all versions of the Houzez WordPress theme up to 4.1.6, stemming from insecure deserialization in saved-search-item.php. This allows authenticated attackers with Subscriber-level access or higher to inject a PHP Object. The vulnerability's impact is conditional; it only poses a risk if another plugin or theme on the site contains a compatible Property-Oriented Programming (POP) chain, which could then lead to arbitrary file deletion, sensitive data retrieval, or code execution. The vulnerability has a CVSS score of 6.3 (Medium), indicating a network-based attack with low privileges and no user interaction required, potentially leading to low confidentiality, integrity, and availability impacts. However, its EPSS score is very low (0.00081), suggesting a minimal likelihood of exploitation in the wild. Currently, there is no known active exploitation, nor is there publicly available exploit code in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are also absent, which is typical for the vast majority of CVEs.