This vulnerability (CVE-2025-69130) is classified as CWE-502, deserialization of untrusted data, specifically a PHP object injection in the Entrepreneur - Booking for Small Businesses WordPress Theme versions up to 3.1.3. An attacker with low privileges can exploit this to execute arbitrary code remotely without requiring user interaction. The CVSS 3.1 base score is 8.8, reflecting network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor or advisory sources.

Successful exploitation can lead to full compromise of the affected WordPress site, including unauthorized code execution, data disclosure, data modification, and service disruption. The vulnerability is exploitable remotely over the network by an attacker with low privileges and does not require user interaction, making it a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin/theme, limit user privileges, and monitor for suspicious activity related to deserialization processes. Avoid deploying the affected versions in production environments if possible.