Cyber Posture

CVE-2025-52737

High

Published: 22 October 2025

Published
22 October 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0012 30.3th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-52737 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the WP Store Locator WordPress plugin by Tijmen Smit, which allows Object Injection. The issue affects the plugin from unknown initial versions through 2.2.260, as published on 2025-10-22.

The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity. It can be exploited remotely with low attack complexity by an authenticated attacker possessing low privileges, without requiring user interaction and with unchanged scope. Exploitation enables high impacts on confidentiality, integrity, and availability.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-store-locator/vulnerability/wordpress-wp-store-locator-plugin-2-2-260-php-object-injection-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-502

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

CVE-2025-52737 is a deserialization of untrusted data (PHP Object Injection) vulnerability in a public-facing WordPress plugin, exploitable over the network by low-privileged users, directly mapping to T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References