CVE-2025-8145
Published: 20 August 2025
Summary
CVE-2025-8145 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Deeper analysis
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.2.4. The flaw stems from unsafe deserialization of untrusted input inside the get_lead_fields function, corresponding to CWE-502, and carries a CVSS 3.1 score of 8.8.
Unauthenticated attackers can supply a serialized object to trigger the injection. When a property-oriented programming chain present in the Contact Form 7 plugin is also available, the attacker can delete arbitrary files on the server; under certain server configurations this can further lead to remote code execution.
Public references from Wordfence and the plugin’s Subversion repository document the affected code path but do not detail specific patch versions or mitigation steps beyond the published description. The associated EPSS score remains flat at 0.0206 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28794
Vulnerability details
The Redirection for Contact Form 7 plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.2.4 via deserialization of untrusted input in the get_lead_fields function. This makes it possible for unauthenticated attackers to…
more
inject a PHP Object. The additional presence of a POP chain in a Contact Form 7 plugin allows attackers to delete arbitrary files. Additionally, in certain server configurations, Remote Code Execution is possible
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of a publicly accessible WordPress plugin via deserialization leading to RCE/file deletion.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Remediates the PHP object injection flaw via patching the vulnerable Redirection for Contact Form 7 plugin up to version 3.2.4, preventing deserialization exploits, file deletion, and potential RCE.
Validates untrusted inputs to the get_lead_fields function, blocking malicious serialized data that enables PHP object injection.
Scans WordPress plugins for known vulnerabilities like CVE-2025-8145, identifying the presence of the exploitable version for remediation.