CVE-2025-1971

HighRCE

Published: 22 March 2025

Published

22 March 2025

Modified

09 July 2025

KEV Added

—

Patch

—

CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0032 55.4th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-1971 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Webtoffee Import Export Wordpress Users. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-11 (User-installed Software).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly remediates the PHP object injection vulnerability by requiring timely patching of the affected Export and Import Users and Customers plugin beyond version 2.6.2.

SI-10 Information Input Validation partial match

prevent

Requires validation of untrusted inputs like the 'form_data' parameter to block malicious PHP object injection during deserialization in the plugin's AJAX handlers.

CM-11 User-installed Software partial match

prevent

Prohibits or controls user installation of unapproved software such as the vulnerable WordPress plugin, preventing introduction of the deserialization flaw.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

Deserialization vulnerability in public-facing WordPress plugin enables authenticated admin attackers to inject PHP objects; if chained with a POP chain from another component, facilitates arbitrary code execution on the server.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

NVD Description

The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authenticated attackers,…

with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.

Deeper analysisAI

CVE-2025-1971 is a PHP Object Injection vulnerability (CWE-502) affecting the Export and Import Users and Customers plugin for WordPress in all versions up to and including 2.6.2. The issue arises from deserialization of untrusted input via the 'form_data' parameter in the plugin's export and import AJAX handlers, enabling authenticated attackers with Administrator-level access or higher to inject arbitrary PHP objects. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-03-22.

Exploitation requires an authenticated attacker with administrator privileges or above, who can leverage the deserialization flaw to inject PHP objects. By itself, the vulnerable plugin contains no known Property-Oriented Programming (POP) chain, resulting in no direct impact. However, if another plugin or theme on the target WordPress site provides a POP chain, the attacker could potentially delete arbitrary files, retrieve sensitive data, or execute arbitrary code, depending on the capabilities of that chain.

Mitigation details are available in referenced advisories and sources, including Wordfence threat intelligence and WordPress plugin trac repositories. A patch appears in changeset 3259688, with affected code visible in the export and import AJAX class files; security practitioners should update to a version beyond 2.6.2 via the plugin's developers page on WordPress.org.