CVE-2025-30973
Published: 16 July 2025
Summary
CVE-2025-30973 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-30973 by identifying, reporting, and correcting the deserialization of untrusted data flaw in CoSchool LMS versions through 1.4.3.
Prevents object injection in the CoSchool LMS WordPress plugin by validating the validity, structure, and content of untrusted input data prior to deserialization.
Enforces restrictions on untrusted serialized data inputs to the CoSchool LMS plugin based on type and source, blocking exploitation of the deserialization vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated exploitation of a public-facing WordPress plugin via deserialization/object injection.
NVD Description
Deserialization of Untrusted Data vulnerability in Codexpert, Inc CoSchool LMS coschool allows Object Injection.This issue affects CoSchool LMS: from n/a through <= 1.4.3.
Deeper analysisAI
CVE-2025-30973 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the CoSchool LMS WordPress plugin developed by Codexpert, Inc., enabling Object Injection. The issue affects CoSchool LMS versions from n/a through 1.4.3.
The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical), with attack vector of network (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and unchanged scope (S:U), resulting in high impacts to confidentiality (C:H), integrity (I:H), and availability (A:H). Remote unauthenticated attackers can exploit it to perform object injection via untrusted data deserialization.
Patchstack's advisory (https://patchstack.com/database/Wordpress/Plugin/coschool/vulnerability/wordpress-coschool-lms-1-4-3-php-object-injection-vulnerability?_s_id=cve) documents the PHP Object Injection vulnerability in CoSchool LMS version 1.4.3.
Details
- CWE(s)