CVE-2025-22526
Published: 28 March 2025
Summary
CVE-2025-22526 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 45.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-22526 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the WordPress plugin mywebtonet-performancestats, a PHP/MySQL CPU performance statistics tool. The flaw enables Object Injection and affects all versions up to and including 1.2.1. It received a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for complete system compromise.
A remote, unauthenticated attacker can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows arbitrary code execution, potentially leading to high-impact confidentiality, integrity, and availability violations, such as data theft, modification, or denial of service on the affected WordPress site.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/mywebtonet-performancestats/vulnerability/wordpress-php-mysql-cpu-performance-statistics-plugin-1-2-1-php-object-injection-vulnerability?_s_id=cve details the vulnerability and recommends updating to a patched version beyond 1.2.1 to mitigate the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-14964
Vulnerability details
Deserialization of Untrusted Data vulnerability in mywebtonet PHP/MySQL CPU performance statistics mywebtonet-performancestats allows Object Injection.This issue affects PHP/MySQL CPU performance statistics: from n/a through <= 1.2.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote unauthenticated deserialization flaw in a public-facing WordPress plugin enabling arbitrary code execution, directly mapping to exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of the deserialization of untrusted data flaw in the mywebtonet-performancestats plugin via patching to versions beyond 1.2.1.
Requires validation of untrusted inputs prior to deserialization to block object injection exploits in the vulnerable PHP plugin.
Implements memory protection mechanisms to mitigate arbitrary code execution resulting from successful object injection via the deserialization vulnerability.