What is the CVSS score of CVE-2025-30618?

CVE-2025-30618 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2025-30618?

A critical deserialization vulnerability (CVE-2025-30618) exists in the Rapyd Payment Extension for WooCommerce affecting all versions through 1.2.0, enabling attackers to inject malicious objects…

How to fix or mitigate CVE-2025-30618?

Within 24 hours: Disable the Rapyd Payment Extension for WooCommerce plugin immediately and switch to an alternative payment gateway to maintain business continuity. Within 7 days: Audit payment transaction logs for suspicious activity since the plugin's deployment and review for any indicators of compromise. Within 30 days: Monitor vendor for security patch release, evaluate alternative payment solutions for long-term deployment, and conduct a security assessment of any data potentially exposed through the vulnerable plugin.

WordPress CVE-2025-30618

EUVD-2025-18549 CRITICAL

Deserialization of Untrusted Data (CWE-502)

2025-06-17 audit@patchstack.com

Deserialization WordPress

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18549

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in yuliaz Rapyd Payment Extension for WooCommerce allows Object Injection. This issue affects Rapyd Payment Extension for WooCommerce: from n/a through 1.2.0.

AnalysisAI

Critical deserialization of untrusted data vulnerability in the yuliaz Rapyd Payment Extension for WooCommerce (versions through 1.2.0) that allows unauthenticated remote attackers to perform object injection attacks. The vulnerability has a CVSS score of 9.8 with network-accessible attack vector and no authentication required, meaning any internet-connected attacker can exploit this without user interaction. If actively exploited or proof-of-concept code is available, this represents an immediate risk to all unpatched WooCommerce installations using this payment plugin.

Technical ContextAI

The vulnerability stems from improper deserialization of untrusted data (CWE-502), a common PHP issue where user-controlled input is deserialized using functions like unserialize() without proper validation. The Rapyd Payment Extension for WooCommerce integrates payment processing into WooCommerce e-commerce platforms and likely deserializes payment response data, webhook payloads, or session data from the Rapyd payment gateway or user input. PHP object injection via unserialize() can lead to exploitation of PHP object chains (magic methods like __wakeup(), __destruct(), __toString()) to achieve arbitrary code execution. The affected product is identified via CPE as a WooCommerce plugin from vendor 'yuliaz' affecting versions from an unspecified baseline through 1.2.0, suggesting the vulnerability may have existed since initial release.

RemediationAI

action: Immediate Patching; description: Update the Rapyd Payment Extension for WooCommerce to a version greater than 1.2.0 (specific patched version not provided in available references; check WordPress Plugin Directory or yuliaz repository for 1.2.1 or later).
action: Vendor Advisory Check; description: Consult official yuliaz/Rapyd security advisories or the WordPress Plugin Directory security page for CVE-2025-30618 to confirm patched version availability and deployment timeline.
action: Temporary Mitigation (if patch unavailable); description: Disable the Rapyd Payment Extension if not immediately needed, or implement Web Application Firewall (WAF) rules to block suspicious deserialization payloads. However, this is not a reliable long-term mitigation for a network-accessible vulnerability.
action: Code-Level Remediation; description: Replace all instances of unserialize() with secure alternatives: use json_decode() for JSON data, or use safe-by-default deserialization libraries. Validate and sanitize all payment data before processing.
action: Input Validation; description: Implement strict input validation on all webhook endpoints and payment response handlers; reject non-expected data types and structures before any deserialization occurs.