CVE-2025-23914CWE-502

WordPress Muzaara Google Ads Report Plugin <= 3.1 - PHP Object Injection vulnerability

Critical · published January 22, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
45.7
In the wild
Unconfirmed
What it is

🔥 An object injection vulnerability in Muzaara Google Ads Report could let attackers take control of your application! Think of it like a delivery service that blindly accepts any package without checking its contents — if the wrong package gets through, it could wreak havoc! An attacker could exploit this vulnerability to run arbitrary code within your application, leading to potentially devastating consequences like data theft or system compromise. This isn’t just a nuisance; it poses a serious threat to your business's integrity and confidentiality!

Put simply

Think of it like a delivery service that blindly accepts any package without checking its contents — if the wrong package gets through, it could wreak havoc! This vulnerability arises from the deserialization of untrusted data, allowing attackers to inject malicious objects into the application. Consequently, it can execute harmful code remotely, making it a critical risk for users of Muzaara Google Ads Report versions up to 3.1.

What to do

An attacker could exploit this vulnerability to run arbitrary code within your application, leading to potentially devastating consequences like data theft or system compromise. This isn’t just a nuisance; it poses a serious threat to your business's integrity and confidentiality! To protect your application, immediately update to the latest version of the Muzaara Google Ads Report. Additionally, implement strict validation on all incoming data to prevent untrusted payloads from reaching your application. Regularly audit your codebase to ensure ongoing security! You've got this! Follow these steps, and you'll bolster your defenses in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00557 · 45.7th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2025-01-22T15:42Z
EPSS history
Timeline
  • 22 JAN 15:42Z
    WordPress Muzaara Google Ads Report Plugin <= 3.1 - PHP Object Injection vulnerability
    cvelistv5