This vulnerability (CVE-2025-69130) is a PHP Object Injection flaw in the Entrepreneur - Booking for Small Businesses WordPress Theme by Themovation, affecting versions up to 3.1.3. It arises from unsafe deserialization of untrusted data, enabling an attacker with low privileges to execute malicious code or manipulate application behavior, leading to full compromise of confidentiality, integrity, and availability. The CVSS v3.1 score is 8.8, indicating high severity with network attack vector, low attack complexity, and no user interaction required. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

Successful exploitation can lead to complete compromise of the affected WordPress theme, allowing attackers to execute arbitrary code, manipulate data, and disrupt service availability. The vulnerability impacts confidentiality, integrity, and availability at a high level, potentially affecting the entire WordPress site using the vulnerable theme version.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict privileges of users who can upload or modify theme files and monitor for suspicious activity related to the theme. Avoid using affected versions (<=3.1.3) in production environments where possible.