Cyber Posture

CVE-2025-49869

HighRCE

Published: 14 August 2025

Published
14 August 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 36.5th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-49869 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates the CVE by requiring timely identification, reporting, and patching of the deserialization flaw in the Eventin WordPress plugin up to version 4.0.31.

prevent

Prevents object injection by enforcing validation, verification, filtering, or quarantine of untrusted data prior to deserialization in the plugin.

detect

Facilitates early detection of the deserialization vulnerability through periodic vulnerability scanning of WordPress plugins and hosted applications.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Why these techniques?

PHP object injection via untrusted deserialization in a public-facing WordPress plugin directly enables remote exploitation of web applications (T1190) by authenticated users and facilitates privilege escalation or RCE (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.0.31.

Deeper analysisAI

CVE-2025-49869 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Arraytics Eventin WordPress plugin, also known as wp-event-solution. This flaw enables Object Injection and affects all versions of the plugin up to and including 4.0.31. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.

The vulnerability can be exploited over the network by low-privileged authenticated users (PR:L) with low attack complexity and no user interaction required. Successful exploitation allows attackers to inject malicious objects through untrusted deserialization, potentially leading to high-impact outcomes such as unauthorized data access, modification, or system disruption.

Patchstack has documented this PHP Object Injection vulnerability specific to Eventin plugin version 4.0.31, providing details for WordPress security practitioners via their database.

Details

CWE(s)

CVEs Like This One

CVE-2026-24954Shared CWE-502
CVE-2026-27685Shared CWE-502
CVE-2025-14476Shared CWE-502
CVE-2025-60215Shared CWE-502
CVE-2025-36072Shared CWE-502
CVE-2025-59245Shared CWE-502
CVE-2026-22346Shared CWE-502
CVE-2026-24978Shared CWE-502
CVE-2026-24981Shared CWE-502
CVE-2025-50004Shared CWE-502

References