CVE-2025-0855CRITICAL 9.8EPSS p41.5%

CVE-2025-0855CVE-2025-0855

Description

The PGS Core plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.8.0 via deserialization of untrusted input in the 'import_header' function. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Scoring

CVSS 3.19.8 (CRITICAL)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS0.55% probability of exploitation · percentile 41.5% · 2026-06-19T12:03:05Z
Published2025-05-06
Last modified2026-04-15

Underlying weaknesses· 1

CWE-502

References

  1. https://docs.potenzaglobalsolutions.com/docs/ciyashop-wp/changelog/
  2. https://www.wordfence.com/threat-intel/vulnerabilities/id/5dfc2249-3761-49c6-966e-73c33be74c0e?source=cve

1

TypeTargetConfidenceTier
WeaknessDeserialization of Untrusted Datacwe-5020%live

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2025-0724
CVE
CVE-2025-2332
CVE
CVE-2025-7504
CVE
CVE-2026-0910
CVE
CVE-2026-7566
CVE
CVE-2025-0956
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.