What is the CVSS score of CVE-2025-49331?

CVE-2025-49331 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by CVE-2025-49331?

A critical deserialization vulnerability in impleCode eCommerce Product Catalog (versions through 3.4.3) allows attackers to inject malicious objects, potentially leading to unauthorized access, data…

How to fix or mitigate CVE-2025-49331?

Within 24 hours: Identify all systems running eCommerce Product Catalog versions 3.4.3 and below; isolate affected systems from direct internet access if possible. Within 7 days: Implement compensating controls (WAF rules blocking deserialization payloads, network segmentation to restrict catalog access); establish monitoring for exploitation attempts. Within 30 days: Evaluate upgrade path to version 3.4.4 or later when available; conduct forensic review for signs of prior exploitation.

Wordpress Plugin CVE-2025-49331

EUVD-2025-28296 HIGH

Deserialization of Untrusted Data (CWE-502)

2025-06-17 audit@patchstack.com

WordPress Deserialization Wordpress Plugin

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-28296

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

HIGH 7.2

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in impleCode eCommerce Product Catalog allows Object Injection. This issue affects eCommerce Product Catalog: from n/a through 3.4.3.

AnalysisAI

Deserialization of untrusted data vulnerability in impleCode eCommerce Product Catalog versions up to 3.4.3 that allows authenticated attackers with high privileges to perform object injection attacks. The vulnerability enables remote code execution or unauthorized data manipulation through malicious serialized objects. While the CVSS score of 7.2 is moderate-to-high, the requirement for high privileges (PR:H) significantly limits real-world exploitability; however, this should not be underestimated in multi-tenant or insider threat scenarios.

Technical ContextAI

This vulnerability stems from unsafe deserialization practices (CWE-502) in the impleCode eCommerce Product Catalog application, likely in PHP or a similar language that supports object serialization. The root cause is the application's failure to validate or sanitize serialized data before unserializing it, allowing an attacker to instantiate arbitrary object types with attacker-controlled properties. This is a classic object injection attack where gadget chains in the application or its dependencies can be leveraged to achieve remote code execution or other malicious outcomes. The affected product is impleCode eCommerce Product Catalog spanning versions from an unspecified baseline through version 3.4.3, suggesting the vulnerability may have existed for an extended period across multiple releases.

RemediationAI

Immediate patch: Upgrade impleCode eCommerce Product Catalog to version 3.4.4 or later once available from the vendor. 2. Validate against vendor advisory: Check impleCode's official security bulletin for patch release dates and deployment procedures. 3. Temporary mitigations (if patching is delayed): (a) Restrict administrative and high-privilege user access to trusted personnel; implement principle of least privilege. (b) Monitor serialized object handling and deserialization calls in application logs for suspicious patterns. (c) Disable or sandbox the affected module if possible without disrupting core functionality. (d) Implement input validation and type-checking on all deserialization operations. (e) Apply web application firewall (WAF) rules to detect and block malicious serialized payloads. 4. Long-term: Consider implementing a deserialization allowlist (whitelist) for safe object types, or migrate to safer serialization formats (JSON) where feasible.