Security readout for executives and security teams
Plain-English summary
A WordPress plugin called WP Last Modified Info has a flaw that lets a logged-in user with low privileges trick the site into running attacker-controlled code. Any WordPress site using version 1.9.4 or older is at risk, which can lead to full site takeover, defacement, or data theft.
Executive priority
Treat as a high-priority patch this week for any WordPress property using this plugin. Successful exploitation can compromise the site, harm brand trust, and create a foothold for further intrusion. Cost to remediate is low; cost of inaction can be material.
Technical view
CVE-2025-52756 is a CWE-94 code injection issue in the WP Last Modified Info plugin (versions through 1.9.4) that Patchstack characterizes as Remote Code Inclusion. CVSS 3.1 is 7.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L), indicating network-reachable abuse by an authenticated low-privilege actor with scope change across the WordPress instance.
Likely exposure
WordPress sites running the WP Last Modified Info plugin at version 1.9.4 or earlier where contributors, authors, or other low-privilege accounts exist or can be created via open registration. Marketing, publishing, and multi-author blogs commonly meet these conditions.
Exploitation context
Not listed in CISA KEV and no public exploitation is cited in the source bundle. The CVSS vector requires only low privileges and no user interaction, so weaponization barriers are modest once a usable account exists. Treat as a credible internal-abuse and credential-stuffing target.
Researcher notes
CWE-94 with scope change suggests the injection escapes the plugin's context to influence the broader WordPress runtime. The Patchstack slug references 1.9.2, while the CVE record covers through 1.9.4, so confirm the exact fixed version with the vendor before signing off. No public PoC is cited in the bundle.
Mitigation direction
- Inventory WordPress sites and identify any using WP Last Modified Info plugin.
- Update the plugin to the latest fixed version per vendor and Patchstack guidance.
- If no fix is available, deactivate and remove the plugin until patched.
- Disable open user registration and audit contributor and author accounts.
- Rotate credentials for low-privilege WordPress users and enforce MFA where possible.
- Place a WAF or virtual patch in front of affected sites while remediating.
Validation and detection
- Confirm installed plugin version under wp-content/plugins/wp-last-modified-info.
- Cross-check the running version against Patchstack's advisory for the fixed release.
- Review WordPress audit logs for unexpected plugin, theme, or file changes.
- Inspect web server logs for anomalous POSTs to plugin or admin-ajax endpoints.
- Scan the filesystem for unfamiliar PHP files or webshells in uploads and plugin directories.
- Verify low-privilege user accounts and recent role escalations.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-94: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-52756 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L3.13.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.4HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Control of Generation of Code ('Code Injection')
Improper Control of Generation of Code ('Code Injection') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.