What is the CVSS score of CVE-2025-52737?

CVE-2025-52737 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of WP Store Locator are affected by CVE-2025-52737?

WP Store Locator, a WordPress plugin through version 2.2.260, contains a high-severity PHP object injection flaw that a low-privileged authenticated user such as a subscriber or contributor could…

How to fix or mitigate CVE-2025-52737?

Within 24 hours, inventory all WordPress sites running WP Store Locator through version 2.2.260 and treat them as exposed; if the plugin is not business-critical, deactivate or remove it immediately, and if it must remain, restrict subscriber, contributor, and other low-privileged authenticated roles, review user accounts, and enable logging or alerting for unusual serialized input or plugin activity. Within 7 days, apply compensating controls such as a virtual patch or WAF rule targeting PHP object injection against the WP Store Locator endpoint, continue deactivating the plugin on high-value sites, and confirm no unexplained new subscriber or contributor accounts or administrative changes have occurred. Within 30 days, monitor the vendor for a fixed WP Store Locator version beyond 2.2.260, test and deploy any vendor-released update promptly, and if no vendor-released patch has been identified by that time, replace the plugin with a maintained alternative or keep it disabled until a vendor-released patch is confirmed and applied.

WP Store Locator CVE-2025-52737

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Plugin

8.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable plugin endpoint (AV:N), no special timing (AC:L), requires an authenticated account per the object-injection context (PR:L), no interaction (UI:N); object injection can yield full compromise, so C/I/A:H.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Oct 08, 2026 - 13:10 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Tijmen Smit WP Store Locator wp-store-locator allows Object Injection.This issue affects WP Store Locator: from n/a through <= 2.2.260.

AnalysisAI

PHP object injection (CWE-502) in the WordPress plugin WP Store Locator through version 2.2.260 allows an authenticated attacker to pass crafted serialized data into a PHP unserialize() sink, potentially achieving arbitrary object instantiation and, if a usable POP gadget chain exists in the loaded codebase, serious downstream impact scored at CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Because the vector carries PR:L, exploitation requires a low-privileged authenticated account such as a subscriber or contributor - anonymous exploitation is not indicated - and no user interaction is needed. EPSS is low at 0.46% (38th percentile) and there is no CISA KEV listing; no public exploit identified at time of analysis.

Technical ContextAI

The flaw is a classic PHP Object Injection sink (CWE-502) in the WordPress plugin WP Store Locator (slug wp-store-locator, vendor Tijmen Smit), affecting versions from n/a through 2.2.260. In this class of bug, attacker-controlled input reaches PHP's unserialize() (or an equivalent unserialization path) without adequate validation or an allowed_classes restriction, letting the attacker control the class and properties of an instantiated object rather than just plain data. Object injection by itself is inert: real impact depends on the presence of a reachable PHP POP (property-oriented programming) gadget chain - a sequence of magic methods such as __wakeup, __destruct, or __toString - supplied by the plugin itself, the active theme, WordPress core, or other installed plugins. WordPress's plugin architecture makes gadget availability environment-specific, so the same request may be harmless on one site and lead to serious consequences (file operations, SQL execution, or code execution primitives) on another. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects network reachability, low attack complexity, an authenticated (low-privilege) prerequisite, no user interaction, and high confidentiality, integrity, and availability impact should a usable chain be present.

Affected ProductsAI

WP Store Locator, the WordPress plugin maintained by Tijmen Smit (plugin slug wp-store-locator), is affected in all versions up to and including 2.2.260, as documented in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-store-locator/vulnerability/wordpress-wp-store-locator-plugin-2-2-260-php-object-injection-vulnerability?_s_id=cve. No CPE string was supplied in the source data, but the affected component is unambiguously the WordPress plugin package rather than WordPress core itself; any site running the plugin at 2.2.260 or earlier is in scope, while deployments already on a later release are not covered by this CVE. Impact is conditional on the site's configuration, specifically whether low-privilege self-registration is open and whether a reachable PHP gadget chain exists among the installed plugins and theme.

RemediationAI

No vendor-released patch version is specified in the available data, so the primary action is to check the WP Store Locator plugin repository and WordPress.org plugin page for a release later than 2.2.260 and update to it, using the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-store-locator/vulnerability/wordpress-wp-store-locator-plugin-2-2-260-php-object-injection-vulnerability?_s_id=cve as the tracking reference. If no fixed release is confirmed, deactivate and remove the plugin entirely where feasible, accepting the loss of store-locator functionality as the trade-off for eliminating the sink. Because the CVSS vector is PR:L, tighten account provisioning as a compensating control: disable open/low-privilege self-registration and audit existing subscriber and contributor accounts, recognising that this only reduces the attack surface and does not fix the underlying unserialize() flaw. Additional defense-in-depth measures include deploying a WAF or virtual-patching rule that blocks serialized-object payloads (for example strings containing 'O:' patterns) directed at the plugin's endpoints, and, where practical, hardening the environment against gadget chains by keeping WordPress core, themes, and all other plugins updated so known POP gadgets are not left available - noting that generic hardening cannot be guaranteed to remove every chain and that WAF rules may generate false positives on legitimate serialized data.