CVE-2025-53572 is a high-severity Deserialization of Untrusted Data vulnerability (CWE-502) affecting the emarket-design WP Easy Contact plugin for WordPress, specifically versions up to and including 4.0.1. This flaw allows for Object Injection, carrying a CVSS v3.1 score of 8.1 (High) due to its network-exploitable nature, requiring no authentication or user interaction, and potentially leading to high impact on confidentiality, integrity, and availability despite high attack complexity. Currently, there is no evidence of active exploitation, with no public exploits available in Metasploit, Nuclei, or ExploitDB, and minimal community discussion or media coverage, as reflected by its low EPSS score.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 0, <= 4.0.1CPE match | cpe:2.3:a:emarketdesign:wp_easy_contact:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.