Cyber Posture

CVE-2025-24601

Critical

Published: 27 January 2025

Published
27 January 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0023 46.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-24601 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the ThimPress FundPress WordPress plugin, enabling Object Injection. This issue affects FundPress versions from n/a through 2.0.6, as published on 2025-01-27.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it can be exploited over the network by unauthenticated attackers requiring low complexity and no user interaction. Successful exploitation allows attackers to achieve high impacts on confidentiality, integrity, and availability through object injection.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/fundpress/vulnerability/wordpress-fundpress-plugin-2-0-6-php-object-injection-vulnerability?_s_id=cve documents the vulnerability in the WordPress FundPress plugin version 2.0.6 and provides relevant mitigation guidance.

Details

CWE(s)
CWE-502

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The CVE describes an unauthenticated remote deserialization/object injection vulnerability in a public-facing WordPress plugin, directly enabling exploitation of a web application as per T1190.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References