CVE-2025-22526CWE-502

WordPress PHP/MySQL CPU performance statistics Plugin <= 1.2.1 - PHP Object Injection vulnerability

Critical · published March 28, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
45.1
In the wild
Unconfirmed
What it is

🚨 An unchecked box is all it takes to unleash chaos! This deserialization vulnerability in mywebtonet allows attackers to inject malicious objects, potentially compromising your entire system. 🔥 Think of it like a restaurant that serves meals based solely on customer feedback without verifying the ingredients—one suspicious order can spoil the entire kitchen! The consequences could be absolutely devastating: an attacker could manipulate your server's performance statistics, change configurations, or even execute arbitrary code. This means they could gain full control over your system—yikes!

Put simply

Think of it like a restaurant that serves meals based solely on customer feedback without verifying the ingredients—one suspicious order can spoil the entire kitchen! The vulnerability stems from the deserialization of untrusted data in mywebtonet, which allows attackers to successfully perform object injection. Versions from n/a through 1.2.1 are affected, making it a critical issue for users!

What to do

The consequences could be absolutely devastating: an attacker could manipulate your server's performance statistics, change configurations, or even execute arbitrary code. This means they could gain full control over your system—yikes! Upgrade to version 1.2.2 immediately to patch this vulnerability. Additionally, implement strict validation for all serialized data to prevent any untrusted input from being processed. Regularly audit your dependencies to ensure you're running secure versions! You've got this! By following these steps, you'll lock down your systems and keep the internet safe! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00549 · 45.1th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2025-03-28T15:12Z
EPSS history
Timeline
  • 28 MAR 15:12Z
    WordPress PHP/MySQL CPU performance statistics Plugin <= 1.2.1 - PHP Object Injection vulnerability
    cvelistv5