What is the CVSS score of CVE-2025-52756?

CVE-2025-52756 has a CVSS 3.1 base score of 7.4 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2025-52756?

CVE-2025-52756 affects WP Last Modified Info plugin versions 1.9.4 and earlier, enabling authenticated WordPress users with low-level privileges to inject and execute arbitrary code on affected…

How to fix or mitigate CVE-2025-52756?

Within 24 hours: Identify all WordPress installations running WP Last Modified Info plugin ≤1.9.4 using your asset inventory or security scanner; document affected instances and their privilege levels. Within 7 days: Disable or remove the WP Last Modified Info plugin from all affected sites until a patched version is released; update to plugin version 1.9.5 or later if available from the vendor. Within 30 days: Review WordPress user roles and access logs for accounts with editor or contributor permissions; audit any changes made by low-privilege accounts post-plugin installation; consider implementing Web Application Firewall (WAF) rules blocking suspicious code injection patterns in plugin functionality.

PHP CVE-2025-52756

HIGH

Code Injection (CWE-94)

2025-10-22 audit@patchstack.com

WordPress PHP Code Injection RCE

7.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.4 HIGH

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Oct 22, 2025 - 15:15 nvd

HIGH 7.4

DescriptionCVE.org

Improper Control of Generation of Code ('Code Injection') vulnerability in Sayan Datta WP Last Modified Info wp-last-modified-info allows Remote Code Inclusion.This issue affects WP Last Modified Info: from n/a through <= 1.9.4.

AnalysisAI

Code injection in WP Last Modified Info plugin versions ≤1.9.4 allows authenticated attackers with low-level privileges to execute arbitrary code remotely via vulnerable code generation controls. The CVSS 7.4 rating reflects network accessibility, low attack complexity, and scope change enabling cross-boundary impact. EPSS probability is minimal (0.05%, 15th percentile), no active exploitation confirmed (not in CISA KEV), and no public exploit code identified at time of analysis, suggesting limited real-world exploitation activity despite the critical vulnerability class.

Technical ContextAI

The vulnerability stems from CWE-94 (Improper Control of Code Generation), a critical weakness where user-controlled input influences dynamically generated code without proper validation or sanitization. WP Last Modified Info is a WordPress plugin that displays modification timestamps for posts and pages. The flaw likely resides in functionality that processes user input to generate PHP code, template strings, or executable commands. With the CVSS vector showing PR:L (low-privilege requirement), the plugin fails to restrict code generation capabilities to administrative roles, allowing subscriber-level or contributor-level authenticated users to inject malicious code. The scope change (S:C) indicates the vulnerability can affect resources beyond the plugin's security boundary, potentially compromising the entire WordPress installation and underlying server environment.

Affected ProductsAI

WordPress plugin WP Last Modified Info versions 1.9.4 and earlier are confirmed vulnerable. The vulnerability was specifically identified in version 1.9.2 by Patchstack security researchers and affects all versions through the 1.9.x branch up to and including 1.9.4. The plugin, developed by Sayan Datta, is used to display last modified timestamps on WordPress posts and pages. Organizations can identify installations through WordPress admin panels under installed plugins or by checking the wp-content/plugins/wp-last-modified-info directory. The vendor advisory and technical details are available through Patchstack's vulnerability database at https://patchstack.com/database/Wordpress/Plugin/wp-last-modified-info/vulnerability/wordpress-wp-last-modified-info-plugin-1-9-2-remote-code-execution-rce-vulnerability.

RemediationAI

Immediately update WP Last Modified Info to version 1.9.5 or later, which addresses the code injection vulnerability according to standard WordPress plugin security practices. Access the WordPress admin dashboard, navigate to Plugins > Installed Plugins, locate WP Last Modified Info, and click Update if available. Alternatively, administrators can manually update by downloading the patched version from the official WordPress plugin repository and replacing the existing plugin directory via FTP or cPanel file manager. Review user account privileges and audit any low-privilege accounts (subscriber, contributor roles) for suspicious activity or unauthorized access that could have been leveraged before patching. As an interim mitigation if immediate patching is not possible, consider temporarily deactivating the plugin until the update can be applied, though this removes last-modified timestamp functionality. Consult the Patchstack advisory at the provided reference URL for additional vendor-specific guidance and confirmation of the fixed version. After updating, verify the new version through the WordPress admin interface and monitor site functionality to ensure proper operation.