CVE-2025-27300
Published: 24 February 2025
Summary
CVE-2025-27300 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-27300 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the giuliopanda ADFO admin-form WordPress plugin, enabling Object Injection. The issue affects ADFO versions from n/a through 1.9.1 and was published on 2025-02-24.
With a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), the vulnerability can be exploited remotely with low attack complexity by authenticated users possessing high privileges, such as administrators. No user interaction is required, and successful exploitation allows attackers to achieve high impacts on confidentiality, integrity, and availability.
The Patchstack database provides details on this vulnerability in the WordPress ADFO plugin version 1.9.1, including assessment of the deserialization issue: https://patchstack.com/database/Wordpress/Plugin/admin-form/vulnerability/wordpress-adfo-plugin-1-9-1-deserialization-of-untrusted-data-vulnerability?_s_id=cve.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4330
Vulnerability details
Deserialization of Untrusted Data vulnerability in giuliopanda ADFO admin-form allows Object Injection.This issue affects ADFO: from n/a through <= 1.9.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization of untrusted data vulnerability in a public-facing WordPress plugin enables remote object injection leading to code execution on the server.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of system flaws such as the deserialization vulnerability in ADFO plugin versions <=1.9.1, preventing exploitation through patching.
Mandates validation of information inputs to detect and reject malformed or malicious serialized data before deserialization in the admin-form, directly addressing CWE-502.
Enforces least privilege to limit high-privilege (PR:H) access to the vulnerable admin-form, reducing the attack surface for authenticated administrators.