What is the CVSS score of CVE-2025-52740?

CVE-2025-52740 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Boldermail are affected by CVE-2025-52740?

The Boldermail WordPress plugin (versions up to and including 2.4.0) contains a high-severity vulnerability (CVE-2025-52740) that allows an authenticated low-privilege user to potentially execute…

How to fix or mitigate CVE-2025-52740?

Within 24 hours, disable or remove the Boldermail plugin (all versions up to and including 2.4.0) from all WordPress sites unless it is absolutely business-critical; if it must remain enabled, immediately restrict access to authenticated users with the lowest possible privileges and deploy web application firewall (WAF) rules to block PHP object injection attempts. Within 7 days, conduct a thorough review of WordPress user accounts to enforce least privilege, enable detailed logging for unserialize() calls, and evaluate alternative newsletter plugins that are actively maintained; if a virtual patch becomes available from a security vendor, apply it as a temporary measure. Within 30 days, replace the Boldermail plugin with a secure alternative or, if the vendor releases a patch, apply it after testing in a staging environment; continue monitoring for vendor updates and conduct a compromise assessment to ensure no exploitation has occurred.

Boldermail CVE-2025-52740

HIGH

Deserialization of Untrusted Data (CWE-502)

2025-10-22 audit@patchstack.com

WordPress Deserialization Wordpress Plugin

8.8

CVSS 3.1 · Vendor: patchstack

Severity by source

Vendor (patchstack) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Network-reachable, low-complexity object injection needs a low-privilege account (PR:L) and no interaction; full CIA retained matching vendor, though impact is gadget-chain dependent.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (patchstack).

CVSS VectorVendor: patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Sep 30, 2026 - 23:53 vuln.today

CVE Published

Oct 22, 2025 - 15:15 cve.org

HIGH 8.8

DescriptionCVE.org

Deserialization of Untrusted Data vulnerability in Hernan Villanueva Boldermail boldermail allows Object Injection.This issue affects Boldermail: from n/a through <= 2.4.0.

AnalysisAI

PHP object injection in the Boldermail plugin for WordPress (all versions up to and including 2.4.0) allows a low-privilege authenticated user to pass crafted serialized data into an unserialize() call, enabling arbitrary PHP object instantiation that can escalate to remote code execution, file manipulation, or database compromise when a usable POP gadget chain is reachable. The flaw is network-reachable with low attack complexity and no user interaction (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N). Exploitation is materially constrained by the PR:L authentication prerequisite and by the availability of a gadget chain in the plugin, WordPress core, or another installed plugin; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS score is low (0.53%, 43rd percentile).

Technical ContextAI

The root cause is CWE-502, Deserialization of Untrusted Data. Boldermail accepts attacker-influenced input and passes it to PHP's unserialize(), which reconstructs arbitrary PHP objects from a serialized string. Object injection itself is only the entry point: impact depends on PHP magic methods (__wakeup, __destruct, __toString, __call, etc.) implemented by classes already loaded in the WordPress request that can be chained into a POP (property-oriented programming) gadget chain. If such a chain is reachable through Boldermail, WordPress core, or any co-installed plugin or theme, the injected object graph can be driven to file writes, code execution, or privileged database operations; absent a chain, the practical impact may be limited to type confusion, logic bypass, or denial of service. The advisory attributes the finding to Patchstack (audit@patchstack.com); no CPE identifiers were supplied, so the affected component is identified by the vendor/plugin slug rather than a structured CPE string.

Affected ProductsAI

The vulnerability affects the Boldermail plugin for WordPress, maintained by Hernan Villanueva, across versions from n/a through 2.4.0 inclusive; 2.4.0 is the confirmed upper bound of the affected range. No CPE strings were provided in the source data, so affected instances must be identified by plugin slug (boldermail) and version rather than by structured CPE matching. Any WordPress site with an active Boldermail installation at or below 2.4.0 is potentially exposed, since the vulnerable deserialization path is reachable by an authenticated low-privilege user. The single reference supplied is the vendor/coordinated advisory at https://patchstack.com/database/Wordpress/Plugin/boldermail/vulnerability/wordpress-boldermail-plugin-2-4-0-php-object-injection-vulnerability?_s_id=cve, which should be treated as the authoritative source for the final affected-version enumeration.

RemediationAI

Upgrade the Boldermail plugin past the affected range: the vulnerability applies to versions through 2.4.0, so install the earliest release after 2.4.0 intended as the fix, and confirm the exact remediated version against the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/boldermail/vulnerability/wordpress-boldermail-plugin-2-4-0-php-object-injection-vulnerability?_s_id=cve); note that patch availability is not independently confirmed in the supplied data, so verify with the vendor before assuming an update resolves the issue. If no fixed release is yet installable, remove or deactivate the Boldermail plugin on sites that do not require it - trade-off: loss of the plugin's email/newsletter functionality. Where the plugin must remain active, restrict the low-privilege accounts that can reach the affected endpoint and audit user roles (contributors, subscribers, and any custom low-privilege roles) so that only trusted users have accounts capable of triggering the deserialization path; this reduces the PR:L attack surface but does not eliminate the flaw for legitimate users. Because impact relies on a reachable POP gadget chain, minimizing the installed plugin/theme attack surface and keeping WordPress core and all other components patched lowers the probability that a functional chain exists, though it is a compensating measure rather than a fix. Monitor logs for unusual serialized payloads or unexpected object-related errors in requests handled by Boldermail, and treat any confirmed exploitation attempt as a potential full site compromise requiring credential rotation and malware review.