Deserialization of Untrusted Data Vulnerability in ADFO by giuliopanda
CVE-2025-27300

7.2HIGH

Key Information:

Vendor
Giuliopanda
Status
Adfo
Vendor
CVE Published:
24 February 2025

Summary

The ADFO plugin by giuliopanda has a vulnerability that enables unauthenticated attackers to exploit deserialization of untrusted data, resulting in possible object injection. This risk affects all versions from n/a up to and including 1.9.1. Organizations using this plugin should take immediate action to mitigate potential security threats associated with this vulnerability.

Affected Version(s)

ADFO <= 1.9.1

References

https://patchstack.com/database/wordpress/plugin/admin-fo...
vdb-entry

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phan Trong Quan - VNPT Cyber Immunity (Patchstack Alliance)
.