CVE-2025-53303
Published: 09 September 2025
Summary
CVE-2025-53303 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 29.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Flaw remediation directly mitigates the deserialization vulnerability by patching affected ThemeMove Core plugin versions up to 1.4.2.
Information input validation checks untrusted data before deserialization, preventing object injection by low-privileged attackers.
Least privilege limits the impact of exploitation by restricting capabilities available to low-privileged WordPress users required for this vulnerability.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote deserialization/object injection in public-facing WordPress plugin directly enables exploitation of a network-accessible application (T1190) and subsequent privilege escalation from low-priv authenticated user to full system impact (T1068).
NVD Description
Deserialization of Untrusted Data vulnerability in ThemeMove ThemeMove Core thememove-core allows Object Injection.This issue affects ThemeMove Core: from n/a through <= 1.4.2.
Deeper analysisAI
CVE-2025-53303 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the ThemeMove Core (thememove-core) WordPress plugin, which allows Object Injection. This issue affects ThemeMove Core versions from n/a through 1.4.2 inclusive. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility, low attack complexity, and requirement for only low privileges.
An authenticated attacker with low privileges, such as a standard WordPress user, can exploit this vulnerability remotely without user interaction. Exploitation involves providing untrusted data for deserialization, potentially leading to object injection and high impacts on confidentiality, integrity, and availability of the affected system.
The Patchstack advisory provides details on this WordPress plugin vulnerability, including mitigation guidance, at https://patchstack.com/database/Wordpress/Plugin/thememove-core/vulnerability/wordpress-thememove-core-plugin-1-4-2-php-object-injection-vulnerability?_s_id=cve.
Details
- CWE(s)