CVE-2025-39348 is a critical deserialization flaw (CVSS 9.8) in the Grand Restaurant WordPress theme, in versions up to and including 7.0. It allows PHP object injection and needs no login. Patchstack lists no official patch, so check with the theme author, and remove or replace the theme if you cannot get a fixed version.
What's affected
The record names the ThemeGoods Grand Restaurant theme, from n/a through 7.0. The weakness is deserialization of untrusted data, which the record says allows object injection.
Patchstack's page for this entry lists 7.0 as the vulnerable version and shows no official patched version at the time I read it. The vendor may have shipped a fix since then, so check the theme's changelog and the channel you bought it from.
The record lists the weakness as CWE-502 (deserialization of untrusted data). The CVSS 3.1 score is 9.8 (critical), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vector shows the flaw can be reached over the network, and no login is needed. Confidentiality impact is rated high, integrity high and availability high.
The record does not say this flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false. Patchstack's page rates the issue as high priority and expects it to be exploited at scale, which is a forecast and not a report of attacks. Treat internet facing sites as the priority.
How to check if you're exposed
Check each WordPress install for the theme and its version.
- With WP-CLI, list the theme and its version on each site:
wp theme list --fields=name,status,version | grep -i grand
- Without WP-CLI, open the Themes page in the dashboard and read the version under Grand Restaurant. Compare it with 7.0.
- Look for a changelog or update notice from the theme author that mentions a fix for object injection. If none exists, plan to replace the theme.
- Remember that an inactive theme or plugin can still be reachable on disk. Check the folder under wp-content as well, and delete anything you do not use.
If you manage many sites, the free in-browser dependency scan covers application dependencies, and the Gold directory lets you look up other CVEs by product. Themes and plugins still need to be checked on each site.
What to do now
- Update the Grand Restaurant theme to a fixed version if the author has published one. Confirm the version is newer than 7.0.
- If no fixed version exists, switch to a different theme and delete the vulnerable one from the server. Deactivating alone leaves the files on disk.
- Put a web application firewall rule in front of the site if you must keep the theme running for a short time.
- Check the site for new administrator accounts, changed files and unknown scheduled tasks.
- Take a fresh backup before changing themes, and test the new theme on a staging copy.
- Keep a list of the themes and plugins on every site so you can answer the next advisory in minutes.
Why it matters
PHP object injection happens when an application turns stored text back into PHP objects without checking where that text came from. If an attacker can supply the text, the application may build objects it never meant to. Whether that becomes a real problem depends on the classes available in the code that is loaded, which is why themes and plugins that ship many classes are common sources.
The record lists CWE-502, deserialization of untrusted data, and a score of 9.8, which is the high end for a network flaw that needs no privileges. Themes are easy to overlook in a patch process because they are not updated through the same route as WordPress core. A site can run for years on a theme that no longer gets fixes.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is there a patched version of the Grand Restaurant theme?
Patchstack's page lists no official patch at the time of review. Check the theme's changelog and the marketplace you bought it from before assuming one exists.
What if I cannot replace the theme today?
Reduce exposure first: put the site behind a firewall rule or restrict access while you plan the switch, and watch for unexpected admin accounts or file changes.
Sources
- Gold entry for CVE-2025-39348
- NVD record for CVE-2025-39348, published 2025-05-19, as summarized above
- Patchstack entry for Grand Restaurant 7.0
Last reviewed: 18 October 2026.
