CVE-2025-26936

CriticalRCE

Published: 10 March 2025

Published

10 March 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Score 0.0022 44.8th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26936 is a critical-severity Code Injection (CWE-94) vulnerability. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 44.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-26936 is an Improper Control of Generation of Code ('Code Injection') vulnerability, classified under CWE-94, in the FRESHFACE Fresh Framework WordPress plugin (fresh-framework). This issue affects all versions from n/a through 1.70.0 inclusive. Published on 2025-03-10, it carries a CVSS v3.1 base score of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), marking it as critically severe due to its potential for widespread remote exploitation.

The vulnerability enables unauthenticated attackers to exploit it remotely over the network with low complexity and no user interaction required. Successful exploitation grants remote code execution (RCE), allowing full compromise of the affected WordPress site with high impacts on confidentiality, integrity, and availability, alongside a scope change that could extend control beyond the vulnerable component.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/fresh-framework/vulnerability/wordpress-fresh-framework-plugin-1-70-0-unauthenticated-remote-code-execution-rce-vulnerability?_s_id=cve documents the unauthenticated RCE vulnerability in Fresh Framework plugin version 1.70.0.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-7721

Vulnerability details

Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Fresh Framework fresh-framework allows Code Injection.This issue affects Fresh Framework: from n/a through <= 1.70.0.

CWE(s): CWE-94

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

The CVE describes an unauthenticated code injection vulnerability in a public-facing WordPress plugin enabling remote code execution, directly mapping to T1190 for exploitation of public-facing applications and facilitating T1059 for command/script execution via the injected code.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0