Cyber Resilience

CVE-2025-26885

HighRCE

Published: 03 March 2025

Published
03 March 2025
Modified
29 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0019 41.1th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26885 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2025-26885 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Beaver Builder WordPress Assistant plugin that allows Object Injection. Published on 2025-03-03T14:15:56.360, it affects WordPress Assistant versions from n/a through <= 1.5.1. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

Exploitation requires network access, low attack complexity, high privileges (PR:H), and no user interaction. An attacker with sufficient privileges can achieve high impacts on confidentiality, integrity, and availability, such as through arbitrary object injection leading to potential remote code execution or system compromise.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/assistant/vulnerability/wordpress-assistant-plugin-1-5-1-php-object-injection-vulnerability?_s_id=cve details the PHP object injection vulnerability in the WordPress Assistant plugin version 1.5.1 and provides associated mitigation guidance.

EU & UK References

Vulnerability details

Deserialization of Untrusted Data vulnerability in Beaver Builder WordPress Assistant assistant allows Object Injection.This issue affects WordPress Assistant: from n/a through <= 1.5.1.

CWE(s)
CWE-502

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

PHP object injection via deserialization in public-facing WordPress plugin enables remote code execution, directly mapping to exploitation of public-facing applications (T1190) and Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-1913Shared CWE-502
CVE-2026-32502Shared CWE-502
CVE-2026-24989Shared CWE-502
CVE-2025-30773Shared CWE-502
CVE-2026-25358Shared CWE-502
CVE-2026-29109Shared CWE-502
CVE-2024-11465Shared CWE-502
CVE-2024-55555Shared CWE-502
CVE-2026-25316Shared CWE-502
CVE-2025-69036Shared CWE-502

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Flaw remediation requires timely patching of the deserialization of untrusted data vulnerability in Beaver Builder WordPress Assistant versions <=1.5.1, directly preventing object injection exploitation.

SI-10 Information Input Validation good match
prevent

Information input validation directly addresses deserialization of untrusted data by ensuring malicious payloads are rejected before processing in the WordPress plugin.

CM-11 User-installed Software good match
prevent

Prohibiting unapproved user-installed software prevents installation and use of the vulnerable Beaver Builder WordPress Assistant plugin.

References