CVE-2025-0767

Medium

Published: 27 February 2025

Published

27 February 2025

Modified

21 May 2025

KEV Added

—

Patch

—

CVSS Score v4 6.3 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0021 43.7th percentile

Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-0767 is a medium-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Melapress Wp Activity Log. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 43.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-0767 is a critical vulnerability in the WP Activity Log WordPress plugin version 5.3.2. It stems from unvalidated user input being passed directly to an unserialize function in the file myapp/classes/Writers/class-csv-writer.php, enabling deserialization of untrusted data (CWE-502). The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), highlighting its severe potential impact.

An unauthenticated attacker can exploit this vulnerability remotely over the network with low attack complexity and no user interaction required. Exploitation allows high-impact compromise of confidentiality, integrity, and availability, potentially leading to arbitrary code execution or other severe outcomes depending on available deserialization gadgets in the application.

Mitigation details are available in advisories from the WordPress plugin repository at https://co.wordpress.org/plugins/wp-security-audit-log/ and Fluid Attacks at https://fluidattacks.com/advisories/skims-9/. Security practitioners should review these for patch information and update instructions.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-5996

Vulnerability details

WP Activity Log 5.3.2 was found to be vulnerable. Unvalidated user input is used directly in an unserialize function in myapp/classes/Writers/class-csv-writer.php.

CWE(s): CWE-502

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Insecure deserialization in a WordPress plugin's public-facing AJAX endpoint (admin-ajax.php) enables exploitation of a weakness in a web application for initial access.