CVE-2025-52744
Published: 20 February 2026
Summary
CVE-2025-52744 is a high-severity Code Injection (CWE-94) vulnerability. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 21.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 directly prevents code injection (CWE-94) in the Inpersttion WordPress plugin by validating and sanitizing user inputs to block malicious code generation.
SI-2 mitigates CVE-2025-52744 by requiring timely identification, reporting, and remediation of the flaw in plugin versions <=1.0 through patching or removal.
AC-6 reduces the exploitability of this PR:L code injection vulnerability by enforcing least privilege, limiting low-privileged users' access to the vulnerable plugin functionality.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Code injection (CWE-94) in public-facing WordPress plugin directly enables exploitation of the web application (T1190) and facilitates deployment/execution of a web shell for arbitrary code execution (T1100).
NVD Description
Improper Control of Generation of Code ('Code Injection') vulnerability in inpersttion Inpersttion For Theme err-our-team allows Code Injection.This issue affects Inpersttion For Theme: from n/a through <= 1.0.
Deeper analysisAI
CVE-2025-52744 is an Improper Control of Generation of Code ('Code Injection') vulnerability, classified as CWE-94, in the Inpersttion For Theme err-our-team WordPress plugin. This issue affects all versions from n/a through 1.0 inclusive. Published on 2026-02-20, it carries a CVSS v3.1 base score of 7.7 (High), with vector AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L.
Low-privileged users (PR:L) can exploit this vulnerability over the network (AV:N) with high attack complexity (AC:H) and without requiring user interaction (UI:N). Exploitation changes scope (S:C), enabling high confidentiality impact (C:H) alongside low integrity (I:L) and availability (A:L) effects, allowing code injection that leads to arbitrary code execution.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/err-our-team/vulnerability/wordpress-inpersttion-for-theme-plugin-1-0-arbitrary-code-execution-vulnerability?_s_id=cve documents this as an arbitrary code execution vulnerability in the plugin version 1.0 and provides further details on the issue.
Details
- CWE(s)