Deserialization Vulnerability in WPFunnels by WPBeginner
CVE-2025-47530

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
WPfunnels
Vendor
CVE Published:
23 May 2025

What is CVE-2025-47530?

The vulnerability in WPFunnels allows for deserialization of untrusted data, which can lead to potential object injection attacks. Affected users between the unspecified and 3.5.18 versions of the plugin are at risk of having their applications manipulated through malicious input, potentially compromising the security of their WordPress sites. It is advisable for users to update to the latest version to mitigate threats associated with this vulnerability.

Affected Version(s)

WPFunnels <= 3.5.18

References

https://patchstack.com/database/wordpress/plugin/wpfunnel...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

timomangcut (Patchstack Alliance)
.