CVE-2025-7825

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7825", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-18T17:48:11.499Z", "datePublished": "2025-10-03T11:17:21.024Z", "dateUpdated": "2026-04-08T17:23:51.912Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:23:51.912Z"}, "affected": [{"vendor": "wpt00ls", "product": "Schema Plugin For Divi, Gutenberg & Shortcodes", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.3.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Schema Plugin For Divi, Gutenberg & Shortcodes plugin for WordPress is vulnerable to Object Instantiation in all versions up to, and including, 4.3.2 via deserialization of untrusted input via the wpt_schema_breadcrumbs shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present."}], "title": "Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ccb81a3e-744f-4a16-ad9b-1b9dbc09571c?source=cve"}, {"url": "https://wordpress.org/plugins/wp-structured-data-schema/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')", "cweId": "CWE-96", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "baseScore": 6.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "ch4r0n"}], "timeline": [{"time": "2025-11-19T16:34:54.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-02T22:14:01.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-03T13:58:27.244687Z", "id": "CVE-2025-7825", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T13:58:33.363Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7825", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-03T13:58:27.244687Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-03T13:58:30.269Z"}}], "cna": {"title": "Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiation", "credits": [{"lang": "en", "type": "finder", "value": "ch4r0n"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"}}], "affected": [{"vendor": "wpt00ls", "product": "Schema Plugin For Divi, Gutenberg & Shortcodes", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.3.2"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-02T22:14:01.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ccb81a3e-744f-4a16-ad9b-1b9dbc09571c?source=cve"}, {"url": "https://wordpress.org/plugins/wp-structured-data-schema/"}], "descriptions": [{"lang": "en", "value": "The Schema Plugin For Divi, Gutenberg & Shortcodes plugin for WordPress is vulnerable to Object Instantiation in all versions up to, and including, 4.3.2 via deserialization of untrusted input via the wpt_schema_breadcrumbs shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-96", "description": "CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-10-03T11:17:21.024Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7825", "state": "PUBLISHED", "dateUpdated": "2025-10-03T13:58:33.363Z", "dateReserved": "2025-07-18T17:48:11.499Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-03T11:17:21.024Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Schema Plugin For Divi, Gutenberg & Shortcodes", "vendor": "wpt00ls", "versions": [{"lessThanOrEqual": "4.3.2", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Schema Plugin For Divi, Gutenberg & Shortcodes plugin for WordPress is vulnerable to Object Instantiation in all versions up to, and including, 4.3.2 via deserialization of untrusted input via the wpt_schema_breadcrumbs shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present."}, {"lang": "es", "value": "El plugin Schema Plugin For Divi, Gutenberg & Shortcodes para WordPress es vulnerable a la instanciaci\u00f3n de objetos en todas las versiones hasta la 4.3.2, inclusive, a trav\u00e9s de la deserializaci\u00f3n de entrada no confiable mediante el shortcode wpt_schema_breadcrumbs. Esto permite a los atacantes autenticados, con acceso de nivel Colaborador y superior, inyectar un objeto PHP. No se conoce ninguna cadena POP presente en el software vulnerable, lo que significa que esta vulnerabilidad no tiene impacto a menos que otro plugin o tema que contenga una cadena POP est\u00e9 instalado en el sitio. Si una cadena POP est\u00e1 presente a trav\u00e9s de un plugin o tema adicional instalado en el sistema objetivo, puede permitir al atacante realizar acciones como eliminar archivos arbitrarios, recuperar datos sensibles o ejecutar c\u00f3digo, dependiendo de la cadena POP presente."}], "id": "CVE-2025-7825", "lastModified": "2026-10-12T15:10:00.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7825", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-03T13:58:27.244687Z", "version": "2.0.3"}}]}, "published": "2025-10-03T12:15:44.820", "references": [{"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/wp-structured-data-schema/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ccb81a3e-744f-4a16-ad9b-1b9dbc09571c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-96"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T19:22:24.133627+00:00", "value": {"mitigation_remediation": ["Check the plugin\u2019s official source or WordPress plugin repository for an update that addresses the deserialization flaw and upgrade if available; if no update exists, consider uninstalling the plugin until a fix is released.", "Identify all other plugins and themes installed on the site that provide POStionally-Overridden-Object chains; remove or update them to eliminate the necessary chain for exploitation.", "Restrict the use of the wpt_schema_breadcrumbs shortcode to users with Administrator access, or disable the shortcode entirely if it is not required for site functionality."], "summary": {"action": "Assess Impact", "impact": "Object Instantiation via a shortcode that an authenticated Contributor can use can lead to code execution if a POStionally-Overridden-Object (POP) chain is present on the site"}, "threat_synthesis": {"affected_systems": "The affected vendor is wpt00ls and the product is Schema Plugin For Divi, Gutenberg & Shortcodes. Versions up to and including 4.3.2 are vulnerable. No further version information is provided, so any release equal to or earlier than 4.3.2 is at risk.", "description_and_impact": "The vulnerability allows a contributor or higher level user to submit untrusted input to the wpt_schema_breadcrumbs shortcode, which the plugin unserializes without proper validation. This causes PHP object instantiation that can be controlled by the attacker. While the plugin itself has no built\u2011in POStionally-Overridden-Object chain, the potential for severe impact is realized only when an additional plugin or theme contains such a chain. When that condition is met, the attacker could delete files, exfiltrate data, or execute arbitrary code depending on the chain exposed.", "risk_and_exploitability": "The CVSS score of 6.3 indicates a moderate severity whose impact is limited by the need for a supplemental POP chain. The EPSS score of < 1% suggests that exploitation is currently unlikely, and the vulnerability is not listed in CISA\u2019s KEV catalog. Nonetheless, authenticated attackers with Contributor privileges can instantiate objects via the shortcode; if a compatible POP chain is present, they may achieve file deletion, data theft, or code execution. The likely attack vector is authenticated, and the vulnerability requires that a POStionally-Overridden-Object chain be available on the target site."}}}}, "created": "2025-10-06T14:42:53.762518+00:00", "updated": "2026-04-20T19:30:06.165118+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}