CVE-2025-32927 is a critical (CVSS 9.8) deserialization of untrusted data flaw in Chimpstudio's FoodBakery (wp-foodbakery) for WordPress, through version 3.3. It allows PHP object injection. The record names no fixed version, so update to the latest release or remove the component.
What's affected
FoodBakery (wp-foodbakery) from the earliest release through 3.3, per the CVE record and its Patchstack source. No fixed version is named, so read the vendor's change log for any release after 3.3.
The vector shows network access, low complexity, no privileges and no user interaction, with high impact to confidentiality, integrity and availability. That is why the score is 9.8.
FoodBakery is a food ordering and restaurant directory product. If you run a site with it, it faces customers, so assume that the vulnerable surface is public.
How to check if you're exposed
List the plugin and its version:
wp plugin get wp-foodbakery
If the product is installed as part of a bundle or theme package, check the package's own version information in the admin dashboard or the vendor's download area.
Anything at 3.3 or lower is in scope. Also look for abandoned copies on staging servers, which often run older versions.
What to do now
- Update to the newest FoodBakery release available from the vendor.
- If no fix is available, deactivate the plugin, and use a different ordering solution.
- Put a web application firewall in front of the site as a stopgap, understanding that it is not a fix.
- Check the site for new administrator accounts, unexpected files and changed plugin code.
- Restore from backups and rotate credentials if you find signs of compromise.
Why it matters
The class is CWE-502 (Deserialization of Untrusted Data). In PHP, unserializing attacker supplied data lets the caller create objects of classes already loaded by the site. If those classes have methods that run when objects are created or destroyed, the caller can chain them into actions the developer never intended.
That chaining is why object injection ratings are often high even when the flawed plugin looks harmless. The risk depends on the other code present on the site, so you cannot judge safety from the plugin alone.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Quick check
What is PHP object injection?
It is the PHP form of unsafe deserialization. Data from a request is turned back into objects, and a crafted value can cause objects the site already knows to be created in harmful ways.
Sources
Last reviewed: 18 October 2026.
