CVE-2025-27301
Published: 24 February 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-27301 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the WordPress plugin NHR Options Table Manager (nhrrob-options-table-manager) developed by Nazmul Hasan Robin. The flaw enables Object Injection and affects all versions from n/a through 1.1.2. Published on 2025-02-24, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
The vulnerability can be exploited by an attacker with high privileges, such as an authenticated WordPress administrator. Exploitation occurs over the network with low complexity and requires no user interaction. Successful attacks result in high impacts to confidentiality, integrity, and availability on the affected system.
Advisories and mitigation guidance are detailed in the Patchstack database at https://patchstack.com/database/Wordpress/Plugin/nhrrob-options-table-manager/vulnerability/wordpress-nhrrob-options-table-manager-plugin-1-1-2-deserialization-of-untrusted-data-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The deserialization of untrusted data vulnerability in the public-facing WordPress plugin directly enables exploitation of the web application (T1190) by an authenticated administrator over the network, resulting in object injection with high impact on confidentiality, integrity, and availability.