CVE-2025-32928 is a critical (CVSS 9.8) deserialization of untrusted data flaw in the ThemeGoods Altair theme for WordPress, through version 5.2.2. It allows PHP object injection. The record names no fixed version, so update to the latest release or move to a different theme.
What's affected
The Altair theme from ThemeGoods through version 5.2.2, per the CVE record. The Patchstack reference path lists it as a theme, not a plugin. The record does not give a fixed version.
The vector shows network access, low complexity, no privileges and no user interaction, with high impact on confidentiality, integrity and availability.
Themes are easy to forget. They stay installed after you switch to another one, and inactive themes can remain reachable on the server. Check for old copies as well as the active one.
How to check if you're exposed
Read the installed version of the theme:
wp theme get altair
Or open Appearance, then Themes in the WordPress admin, and view the theme details. Anything at 5.2.2 or lower is in scope.
List all installed themes and remove any that you do not use:
wp theme list
What to do now
- Update Altair to the latest version offered by the vendor.
- Delete the theme if you do not use it, including inactive copies.
- If no fixed release exists, switch the site to another theme and remove Altair.
- Check the site for new administrator users and unfamiliar files in wp-content.
- Keep an inventory of the themes and plugins on each site and review it at least monthly.
Why it matters
The class is CWE-502 (Deserialization of Untrusted Data). PHP can rebuild objects from stored text. If that text comes from a request, a caller can pick which objects are created, and a chain of ordinary classes can end up doing harmful work.
This one lives in a theme, which many teams do not scan as carefully as plugins. Themes run the same PHP with the same permissions, so a flaw in one is as serious as a flaw in any plugin. Teams that scan plugins weekly often review themes once a year, which leaves a gap that this kind of flaw sits in. Bring themes into the same update and inventory routine, and delete every one that is not in use.
The record does not mark this CVE as CISA KEV and makes no claim of exploitation in the wild.
Quick check
I switched themes. Am I safe?
Not necessarily. An inactive theme can stay on disk and may still be reachable. Delete themes you do not use.
Sources
Last reviewed: 18 October 2026.
