Cyber Resilience

CVE-2026-25445

HighRCE

Published: 19 March 2026

Published
19 March 2026
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0030 21.6th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-25445 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 21.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-25445 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the WishList Member X WordPress plugin (wishlist-member-x), enabling Object Injection. The issue affects all versions from n/a through 3.29.0 inclusive and was published on 2026-03-19.

With a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the vulnerability can be exploited remotely by a low-privileged authenticated user with low attack complexity and no user interaction required. Successful exploitation could result in high impacts to confidentiality, integrity, and availability, such as arbitrary code execution depending on the deserialized objects.

Patchstack has documented the vulnerability in detail, including specifics on the affected PHP Object Injection flaw in version 3.29.0, available at https://patchstack.com/database/Wordpress/Plugin/wishlist-member-x/vulnerability/wordpress-wishlist-member-x-plugin-3-29-0-php-object-injection-vulnerability?_s_id=cve.

OWASP Top 10 for Web (2025)

A08:2025 Software or Data Integrity Failures

EU & UK References

Vulnerability details

Deserialization of Untrusted Data vulnerability in Membership Software WishList Member X wishlist-member-x allows Object Injection.This issue affects WishList Member X: from n/a through <= 3.29.0.

CWE(s)
CWE-502

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

PHP object injection in public-facing WordPress plugin allows authenticated low-priv user to achieve RCE, directly enabling exploitation of public apps (T1190) and privilege escalation (T1068).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-53560Shared CWE-502
CVE-2026-22346Shared CWE-502
CVE-2025-33243Shared CWE-502
CVE-2026-33858Shared CWE-502
CVE-2024-28777Shared CWE-502
CVE-2026-27338Shared CWE-502
CVE-2026-24978Shared CWE-502
CVE-2026-25360Shared CWE-502
CVE-2025-54007Shared CWE-502
CVE-2026-24954Shared CWE-502

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

SI-10 mandates validation of information inputs, directly preventing deserialization of untrusted data that enables object injection in the WishList Member X plugin.

SI-2 Flaw Remediation good match
prevent

SI-2 requires timely identification, reporting, and correction of system flaws, ensuring the vulnerable WishList Member X plugin versions are patched to eliminate the deserialization vulnerability.

RA-5 Vulnerability Monitoring and Scanning good match
preventdetect

RA-5 implements vulnerability scanning that would identify the PHP object injection flaw in WishList Member X, enabling remediation before low-privileged exploitation.

References