CVE-2025-52756
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Lifecycle Timeline
2Tags
Description
Improper Control of Generation of Code ('Code Injection') vulnerability in Sayan Datta WP Last Modified Info wp-last-modified-info allows Remote Code Inclusion.This issue affects WP Last Modified Info: from n/a through <= 1.9.4.
Analysis
Code injection in WP Last Modified Info plugin versions ≤1.9.4 allows authenticated attackers with low-level privileges to execute arbitrary code remotely via vulnerable code generation controls. The CVSS 7.4 rating reflects network accessibility, low attack complexity, and scope change enabling cross-boundary impact. EPSS probability is minimal (0.05%, 15th percentile), no active exploitation confirmed (not in CISA KEV), and no public exploit code identified at time of analysis, suggesting limited real-world exploitation activity despite the critical vulnerability class.
Technical Context
The vulnerability stems from CWE-94 (Improper Control of Code Generation), a critical weakness where user-controlled input influences dynamically generated code without proper validation or sanitization. WP Last Modified Info is a WordPress plugin that displays modification timestamps for posts and pages. The flaw likely resides in functionality that processes user input to generate PHP code, template strings, or executable commands. With the CVSS vector showing PR:L (low-privilege requirement), the plugin fails to restrict code generation capabilities to administrative roles, allowing subscriber-level or contributor-level authenticated users to inject malicious code. The scope change (S:C) indicates the vulnerability can affect resources beyond the plugin's security boundary, potentially compromising the entire WordPress installation and underlying server environment.
Affected Products
WordPress plugin WP Last Modified Info versions 1.9.4 and earlier are confirmed vulnerable. The vulnerability was specifically identified in version 1.9.2 by Patchstack security researchers and affects all versions through the 1.9.x branch up to and including 1.9.4. The plugin, developed by Sayan Datta, is used to display last modified timestamps on WordPress posts and pages. Organizations can identify installations through WordPress admin panels under installed plugins or by checking the wp-content/plugins/wp-last-modified-info directory. The vendor advisory and technical details are available through Patchstack's vulnerability database at https://patchstack.com/database/Wordpress/Plugin/wp-last-modified-info/vulnerability/wordpress-wp-last-modified-info-plugin-1-9-2-remote-code-execution-rce-vulnerability.
Remediation
Immediately update WP Last Modified Info to version 1.9.5 or later, which addresses the code injection vulnerability according to standard WordPress plugin security practices. Access the WordPress admin dashboard, navigate to Plugins > Installed Plugins, locate WP Last Modified Info, and click Update if available. Alternatively, administrators can manually update by downloading the patched version from the official WordPress plugin repository and replacing the existing plugin directory via FTP or cPanel file manager. Review user account privileges and audit any low-privilege accounts (subscriber, contributor roles) for suspicious activity or unauthorized access that could have been leveraged before patching. As an interim mitigation if immediate patching is not possible, consider temporarily deactivating the plugin until the update can be applied, though this removes last-modified timestamp functionality. Consult the Patchstack advisory at the provided reference URL for additional vendor-specific guidance and confirmation of the fixed version. After updating, verify the new version through the WordPress admin interface and monitor site functionality to ensure proper operation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today