CVE-2025-26885
Published: 03 March 2025
Summary
CVE-2025-26885 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 40.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation requires timely patching of the deserialization of untrusted data vulnerability in Beaver Builder WordPress Assistant versions <=1.5.1, directly preventing object injection exploitation.
Information input validation directly addresses deserialization of untrusted data by ensuring malicious payloads are rejected before processing in the WordPress plugin.
Prohibiting unapproved user-installed software prevents installation and use of the vulnerable Beaver Builder WordPress Assistant plugin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
PHP object injection via deserialization in public-facing WordPress plugin enables remote code execution, directly mapping to exploitation of public-facing applications (T1190) and Unix shell command execution (T1059.004).
NVD Description
Deserialization of Untrusted Data vulnerability in Beaver Builder WordPress Assistant assistant allows Object Injection.This issue affects WordPress Assistant: from n/a through <= 1.5.1.
Deeper analysisAI
CVE-2025-26885 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Beaver Builder WordPress Assistant plugin that allows Object Injection. Published on 2025-03-03T14:15:56.360, it affects WordPress Assistant versions from n/a through <= 1.5.1. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).
Exploitation requires network access, low attack complexity, high privileges (PR:H), and no user interaction. An attacker with sufficient privileges can achieve high impacts on confidentiality, integrity, and availability, such as through arbitrary object injection leading to potential remote code execution or system compromise.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/assistant/vulnerability/wordpress-assistant-plugin-1-5-1-php-object-injection-vulnerability?_s_id=cve details the PHP object injection vulnerability in the WordPress Assistant plugin version 1.5.1 and provides associated mitigation guidance.
Details
- CWE(s)