Cyber Posture

CVE-2025-26900

Critical

Published: 25 February 2025

Published
25 February 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 29.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-26900 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the flexmls Flexmls® IDX (flexmls-idx) WordPress plugin, enabling Object Injection. This issue affects all versions from n/a through 3.14.27.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating that unauthenticated attackers with network access can exploit it remotely with low complexity and no user interaction. Successful exploitation could result in high impacts to confidentiality, integrity, and availability.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/flexmls-idx/vulnerability/wordpress-flexmls-idx-plugin-plugin-3-14-27-php-object-injection-vulnerability?_s_id=cve provides details on this PHP Object Injection vulnerability in the flexmls-idx plugin up to version 3.14.27. Security practitioners should consult the advisory for recommended mitigations.

Details

CWE(s)
CWE-502

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Remote unauthenticated deserialization/object injection vulnerability in a public-facing WordPress plugin directly enables exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References