CVE-2025-26936
Published: 10 March 2025
Summary
CVE-2025-26936 is a critical-severity Code Injection (CWE-94) vulnerability. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents code injection vulnerabilities like CVE-2025-26936 by validating and sanitizing all information inputs at entry points.
Ensures timely remediation of known flaws such as the code injection in Fresh Framework versions through 1.70.0 via patching and updates.
Deploys malicious code protection at system entry points to detect and eradicate injected code leading to RCE in the vulnerable WordPress plugin.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes an unauthenticated code injection vulnerability in a public-facing WordPress plugin enabling remote code execution, directly mapping to T1190 for exploitation of public-facing applications and facilitating T1059 for command/script execution via the injected code.
NVD Description
Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Fresh Framework fresh-framework allows Code Injection.This issue affects Fresh Framework: from n/a through <= 1.70.0.
Deeper analysisAI
CVE-2025-26936 is an Improper Control of Generation of Code ('Code Injection') vulnerability, classified under CWE-94, in the FRESHFACE Fresh Framework WordPress plugin (fresh-framework). This issue affects all versions from n/a through 1.70.0 inclusive. Published on 2025-03-10, it carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), marking it as critically severe due to its potential for widespread remote exploitation.
The vulnerability enables unauthenticated attackers to exploit it remotely over the network with low complexity and no user interaction required. Successful exploitation grants remote code execution (RCE), allowing full compromise of the affected WordPress site with high impacts on confidentiality, integrity, and availability, alongside a scope change that could extend control beyond the vulnerable component.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/fresh-framework/vulnerability/wordpress-fresh-framework-plugin-1-70-0-unauthenticated-remote-code-execution-rce-vulnerability?_s_id=cve documents the unauthenticated RCE vulnerability in Fresh Framework plugin version 1.70.0.
Details
- CWE(s)