CVE-2025-32569CWE-502

WordPress TableOn plugin <= 1.0.4.3 - PHP Object Injection vulnerability

Critical · published April 11, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
59.1
In the wild
Unconfirmed
What it is

🚨 A simple mishap with untrusted data can unleash chaos in your system! This deserialization vulnerability in RealMag777 TableOn puts your entire application at risk. 🔥 Think of it like a restaurant where the chef blindly follows a recipe submitted by a customer without checking the ingredients. If that recipe includes toxic items, it could poison the entire kitchen! An attacker can exploit this vulnerability to inject malicious objects into your application. This means they could execute arbitrary code, gain unauthorized access, or even take complete control of your system, leading to absolutely devastating consequences.

Put simply

Think of it like a restaurant where the chef blindly follows a recipe submitted by a customer without checking the ingredients. If that recipe includes toxic items, it could poison the entire kitchen! This deserialization flaw allows untrusted data to be processed improperly by the TableOn component, enabling object injection that could compromise the application's integrity and security.

What to do

An attacker can exploit this vulnerability to inject malicious objects into your application. This means they could execute arbitrary code, gain unauthorized access, or even take complete control of your system, leading to absolutely devastating consequences. Immediately update your TableOn version to a secure release beyond 1.0.4.3. Ensure that you validate and sanitize all inputs before processing any serialized data. Regularly review your code for additional security audits. You’ve got this! Fix this vulnerability and strengthen your defenses today! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00895 · 59.1th percentile
Weakness
CWE-502 · Deserialization of Untrusted Data
Published
2025-04-11T08:42Z
EPSS history
Timeline
  • 11 APR 08:42Z
    WordPress TableOn plugin <= 1.0.4.3 - PHP Object Injection vulnerability
    cvelistv5