CVE-2025-49869
Published: 14 August 2025
Summary
CVE-2025-49869 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 43.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-49869 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the Arraytics Eventin WordPress plugin, also known as wp-event-solution. This flaw enables Object Injection and affects all versions of the plugin up to and including 4.0.31. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability.
The vulnerability can be exploited over the network by low-privileged authenticated users (PR:L) with low attack complexity and no user interaction required. Successful exploitation allows attackers to inject malicious objects through untrusted deserialization, potentially leading to high-impact outcomes such as unauthorized data access, modification, or system disruption.
Patchstack has documented this PHP Object Injection vulnerability specific to Eventin plugin version 4.0.31, providing details for WordPress security practitioners via their database.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-24777
Vulnerability details
Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.0.31.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
PHP object injection via untrusted deserialization in a public-facing WordPress plugin directly enables remote exploitation of web applications (T1190) by authenticated users and facilitates privilege escalation or RCE (T1068).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely identification, reporting, and patching of the deserialization flaw in the Eventin WordPress plugin up to version 4.0.31.
Prevents object injection by enforcing validation, verification, filtering, or quarantine of untrusted data prior to deserialization in the plugin.
Facilitates early detection of the deserialization vulnerability through periodic vulnerability scanning of WordPress plugins and hosted applications.