CVE-2025-30773
Published: 27 March 2025
Summary
CVE-2025-30773 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 26.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely remediation of flaws, directly eliminating this deserialization vulnerability in TranslatePress versions <=2.9.6 through patching.
SI-10 enforces validation of information inputs, preventing exploitation of untrusted data deserialization leading to object injection in this CVE.
AC-6 least privilege limits the high-privilege (PR:H) access required by attackers to trigger the deserialization vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization/object injection vulnerability in public-facing WordPress plugin enables RCE via crafted input, directly facilitating exploitation of the web app (T1190) and Unix shell command execution (T1059.004).
NVD Description
Deserialization of Untrusted Data vulnerability in Cozmoslabs TranslatePress translatepress-multilingual allows Object Injection.This issue affects TranslatePress: from n/a through <= 2.9.6.
Deeper analysisAI
CVE-2025-30773 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Cozmoslabs TranslatePress WordPress plugin (translatepress-multilingual). Published on 2025-03-27, it enables Object Injection and affects all versions from n/a through 2.9.6.
The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Attackers require high privileges, such as administrator-level access, to exploit it over the network with low complexity and no user interaction. Successful exploitation can lead to high impacts on confidentiality, integrity, and availability, potentially allowing arbitrary code execution or other severe consequences through object injection.
Patchstack has issued an advisory detailing the PHP Object Injection vulnerability in TranslatePress 2.9.6 at https://patchstack.com/database/Wordpress/Plugin/translatepress-multilingual/vulnerability/wordpress-translatepress-2-9-6-php-object-injection-vulnerability?_s_id=cve.
Details
- CWE(s)