CVE-2025-7504
Published: 12 July 2025
Summary
CVE-2025-7504 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Alex.Kirk Friends. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 17.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and SI-10 (Information Input Validation).
Deeper analysis
The Friends plugin for WordPress version 3.5.1 contains a PHP Object Injection vulnerability (CWE-502) that arises from unsafe deserialization of untrusted input supplied through the query_vars parameter. The flaw allows an attacker to inject arbitrary PHP objects, though the plugin itself contains no usable POP chain; any resulting impact therefore depends on the presence of a chain supplied by another installed plugin or theme.
Authenticated users with subscriber-level privileges or higher can trigger the issue, provided they also possess the site’s SALT_NONCE and SALT_KEY values. Successful exploitation can enable deletion of arbitrary files, disclosure of sensitive data, or remote code execution when a suitable POP chain is available on the target system. The CVSS 3.1 score of 7.5 reflects the high attack complexity introduced by the salt requirement and the need for an external POP chain.
Public references point to a fix committed in changeset 3306684 and merged via GitHub pull request 537; administrators should update the Friends plugin to a version containing this change. The associated EPSS score has remained flat at 0.0176 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21210
Vulnerability details
The Friends plugin for WordPress is vulnerable to PHP Object Injection in version 3.5.1 via deserialization of untrusted input of the query_vars parameter This makes it possible for authenticated attackers, with subscriber-level access and above, to inject a PHP Object.…
more
No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present. This requires access to the sites SALT_NONCE and and SALT_KEY to exploit.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
PHP object injection in public-facing WordPress plugin directly enables remote exploitation for arbitrary code execution or file operations via deserialization.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Patching the Friends plugin from version 3.5.1 to the fixed version directly remediates the PHP Object Injection vulnerability in query_vars deserialization.
Validating untrusted input to the query_vars parameter prior to deserialization prevents PHP Object Injection by authenticated attackers.
Enforcing deny-all-permit-by-exception policies for software usage restricts execution of vulnerable plugins like Friends 3.5.1.