Cyber Resilience

CVE-2025-30773

HighRCE

Published: 27 March 2025

Published
27 March 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0020 41.8th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-30773 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 41.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-30773 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Cozmoslabs TranslatePress WordPress plugin (translatepress-multilingual). Published on 2025-03-27, it enables Object Injection and affects all versions from n/a through 2.9.6.

The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Attackers require high privileges, such as administrator-level access, to exploit it over the network with low complexity and no user interaction. Successful exploitation can lead to high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution or other severe consequences through object injection.

Patchstack has issued an advisory detailing the PHP Object Injection vulnerability in TranslatePress 2.9.6 at https://patchstack.com/database/Wordpress/Plugin/translatepress-multilingual/vulnerability/wordpress-translatepress-2-9-6-php-object-injection-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.9.6.

CWE(s)
CWE-502

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

Deserialization/object injection vulnerability in public-facing WordPress plugin enables RCE via crafted input, directly facilitating exploitation of the web app (T1190) and Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-1913Shared CWE-502
CVE-2026-32502Shared CWE-502
CVE-2026-24989Shared CWE-502
CVE-2025-26885Shared CWE-502
CVE-2026-25358Shared CWE-502
CVE-2026-29109Shared CWE-502
CVE-2024-11465Shared CWE-502
CVE-2024-55555Shared CWE-502
CVE-2026-25316Shared CWE-502
CVE-2025-69036Shared CWE-502

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

SI-2 requires timely remediation of flaws, directly eliminating this deserialization vulnerability in TranslatePress versions <=2.9.6 through patching.

SI-10 Information Input Validation good match
prevent

SI-10 enforces validation of information inputs, preventing exploitation of untrusted data deserialization leading to object injection in this CVE.

AC-6 Least Privilege partial match
prevent

AC-6 least privilege limits the high-privilege (PR:H) access required by attackers to trigger the deserialization vulnerability.

References