CVE-2025-53299
Published: 20 August 2025
Summary
CVE-2025-53299 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-53299 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the ThemeMakers Visual Content Composer WordPress plugin, known as tmm_content_composer. This flaw enables Object Injection and affects all versions from unknown initial release through 1.5.8. Published on 2025-08-20, it carries a CVSS v3.1 base score of 9.8, indicating critical severity due to its network accessibility, low attack complexity, lack of required privileges or user interaction, and high potential impact on confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability remotely over the network without privileges or user interaction. Successful exploitation allows object injection via untrusted deserialization, which could lead to severe consequences aligned with the high impact ratings for confidentiality, integrity, and availability.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/tmm_content_composer/vulnerability/wordpress-thememakers-visual-content-composer-plugin-1-5-8-php-object-injection-vulnerability?_s_id=cve details the vulnerability in the WordPress plugin, including information relevant to mitigation and patching.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-25358
Vulnerability details
Deserialization of Untrusted Data vulnerability in ThemeMakers ThemeMakers Visual Content Composer tmm_content_composer allows Object Injection.This issue affects ThemeMakers Visual Content Composer: from n/a through <= 1.5.8.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated exploitation of a public-facing WordPress plugin via PHP object injection (deserialization).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Flaw remediation requires patching the specific deserialization of untrusted data vulnerability in the tmm_content_composer WordPress plugin, directly preventing object injection exploitation.
Information input validation ensures untrusted data is checked and sanitized before deserialization in the vulnerable plugin, blocking object injection attacks.
Vulnerability monitoring and scanning identifies CVE-2025-53299 in the installed plugin version, enabling timely detection and remediation to prevent exploitation.