Cyber Resilience

CVE-2025-53303

HighRCE

Published: 09 September 2025

Published
09 September 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0016 36.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-53303 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-53303 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the ThemeMove Core (thememove-core) WordPress plugin, which allows Object Injection. This issue affects ThemeMove Core versions from n/a through 1.4.2 inclusive. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low attack complexity, and requirement for only low privileges.

An authenticated attacker with low privileges, such as a standard WordPress user, can exploit this vulnerability remotely without user interaction. Exploitation involves providing untrusted data for deserialization, potentially leading to object injection and high impacts on confidentiality, integrity, and availability of the affected system.

The Patchstack advisory provides details on this WordPress plugin vulnerability, including mitigation guidance, at https://patchstack.com/database/Wordpress/Plugin/thememove-core/vulnerability/wordpress-thememove-core-plugin-1-4-2-php-object-injection-vulnerability?_s_id=cve.

EU & UK References

Vulnerability details

Deserialization of Untrusted Data vulnerability in ThemeMove ThemeMove Core thememove-core allows Object Injection.This issue affects ThemeMove Core: from n/a through <= 1.4.2.

CWE(s)
CWE-502

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Remote deserialization/object injection in public-facing WordPress plugin directly enables exploitation of a network-accessible application (T1190) and subsequent privilege escalation from low-priv authenticated user to full system impact (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-54007Shared CWE-502
CVE-2025-60215Shared CWE-502
CVE-2026-24978Shared CWE-502
CVE-2025-49869Shared CWE-502
CVE-2026-27379Shared CWE-502
CVE-2026-27338Shared CWE-502
CVE-2026-33858Shared CWE-502
CVE-2026-6857Shared CWE-502
CVE-2025-36072Shared CWE-502
CVE-2025-64266Shared CWE-502

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
preventrecover

Flaw remediation directly mitigates the deserialization vulnerability by patching affected ThemeMove Core plugin versions up to 1.4.2.

SI-10 Information Input Validation good match
prevent

Information input validation checks untrusted data before deserialization, preventing object injection by low-privileged attackers.

AC-6 Least Privilege partial match
prevent

Least privilege limits the impact of exploitation by restricting capabilities available to low-privileged WordPress users required for this vulnerability.

References