CVE-2025-14044
Published: 12 December 2025
Summary
CVE-2025-14044 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 40.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-14044 is a PHP Object Injection vulnerability in the Visitor Logic Lite plugin for WordPress, affecting all versions up to and including 1.0.3. The issue arises in the `lp_track()` function, which passes unsanitized data from the `lpblocks` cookie directly to PHP's `unserialize()` function, allowing deserialization of untrusted input. This enables injection of a PHP object and is classified as CWE-502, with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated attackers who can access the WordPress site can exploit the vulnerability by supplying a malicious `lpblocks` cookie. Although no known Proof-of-POP (POP) chain exists within the vulnerable plugin, a POP chain provided by an additional plugin or theme on the target system could enable the attacker to delete arbitrary files, retrieve sensitive data, or execute arbitrary code.
Advisories and references, including Wordfence's threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/60fb6928-96fb-4c1f-989c-cc07965b5266?source=cve, detail the vulnerability. Source code references at https://plugins.trac.wordpress.org/browser/logic-pro/tags/1.0.3/logic-lite.php#L131 and https://plugins.trac.wordpress.org/browser/logic-pro/trunk/logic-lite.php#L131 point to the specific vulnerable line in the `lp_track()` function.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-202994
Vulnerability details
The Visitor Logic Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.3 via deserialization of untrusted input from the `lpblocks` cookie. This is due to the `lp_track()` function passing unsanitized cookie…
more
data directly to the `unserialize()` function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code granted they can access the WordPress site.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated PHP Object Injection via crafted cookie in public-facing WordPress plugin directly enables exploitation of public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of untrusted inputs such as the lpblocks cookie before deserialization to prevent PHP object injection.
Mandates identification, reporting, and timely correction of the specific flaw in the lp_track() function that passes unsanitized cookie data to unserialize().
Requires vulnerability scanning to identify the PHP object injection issue in the Visitor Logic Lite WordPress plugin.