CVE-2025-68526
Published: 20 February 2026
Summary
CVE-2025-68526 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-68526 is a Deserialization of Untrusted Data vulnerability in the Modal Popup Box plugin (modal-popup-box) for WordPress, developed by A WP Life. This issue, tied to CWE-502, allows Object Injection and affects all versions from n/a through 1.6.1. Published on 2026-02-20, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting high severity due to its network accessibility, low attack complexity, and potential for significant impacts.
The vulnerability can be exploited by low-privileged authenticated users (PR:L) over the network without requiring user interaction. Attackers can trigger deserialization of untrusted data, leading to object injection with high consequences for confidentiality, integrity, and availability, such as potential remote code execution or system compromise depending on the deserialized objects.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/modal-popup-box/vulnerability/wordpress-modal-popup-box-plugin-1-6-1-php-object-injection-vulnerability?_s_id=cve provides details on the vulnerability, including recommended mitigations such as updating the plugin or applying available patches.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-208079
Vulnerability details
Deserialization of Untrusted Data vulnerability in A WP Life Modal Popup Box modal-popup-box allows Object Injection.This issue affects Modal Popup Box: from n/a through <= 1.6.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unsafe deserialization in public-facing WordPress plugin directly enables exploitation for RCE/system compromise via T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires identification, reporting, and timely remediation of the deserialization of untrusted data flaw in Modal Popup Box plugin versions through <=1.6.1.
Enforces validation of untrusted inputs at system entry points to block malicious serialized data leading to object injection in the plugin.
Provides vulnerability scanning to identify the presence of CVE-2025-68526 in deployed WordPress plugins for subsequent remediation.