CVE-2025-1971
Published: 22 March 2025
Summary
CVE-2025-1971 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Webtoffee Import Export Wordpress Users. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and CM-11 (User-installed Software).
Deeper analysis
The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in versions up to and including 2.6.2. The flaw stems from unsafe deserialization of untrusted input supplied through the form_data parameter, as implemented in the plugin's export and import AJAX handlers. This is tracked as CWE-502 and carries a CVSS 3.1 score of 7.2.
Authenticated users with Administrator privileges or higher can supply a crafted serialized object via the affected parameter. Because the plugin itself contains no POP chain, exploitation requires the presence of a separate vulnerable plugin or theme on the same site; when such a chain exists, an attacker may be able to delete arbitrary files, exfiltrate data, or execute arbitrary code.
The Wordfence advisory and the plugin's Trac changeset 3259688 indicate that the issue was addressed in a subsequent release. Site owners are therefore advised to update the plugin to the newest version available through the WordPress repository.
EPSS for the CVE rose from a low baseline to a peak of 0.0169 on 2026-02-03 before receding to the current value of 0.0032, indicating that exploitation interest increased after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7282
Vulnerability details
The Export and Import Users and Customers plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.2 via deserialization of untrusted input from the 'form_data' parameter. This makes it possible for authenticated attackers,…
more
with Administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization vulnerability in public-facing WordPress plugin enables authenticated admin attackers to inject PHP objects; if chained with a POP chain from another component, facilitates arbitrary code execution on the server.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the PHP object injection vulnerability by requiring timely patching of the affected Export and Import Users and Customers plugin beyond version 2.6.2.
Requires validation of untrusted inputs like the 'form_data' parameter to block malicious PHP object injection during deserialization in the plugin's AJAX handlers.
Prohibits or controls user installation of unapproved software such as the vulnerable WordPress plugin, preventing introduction of the deserialization flaw.