CVE-2025-7504 describes a PHP Object Injection vulnerability in version 3.5.1 of the Friends plugin for WordPress, allowing authenticated attackers with subscriber-level access or higher to inject PHP Objects through untrusted input deserialization. This vulnerability carries a high CVSS score of 8.8, indicating a critical risk due to its low attack complexity and potential for high impact on confidentiality, integrity, and availability if a suitable POP chain is present. While no active exploits, Metasploit modules, or Nuclei templates are currently available, and community discussion is minimal, the vulnerability's impact is contingent on the presence of another plugin or theme providing a POP chain and requires access to the site's SALT_NONCE and SALT_KEY for successful exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.5.2CPE matchmatch criteria | cpe:2.3:a:alex.kirk:friends:*:*:*:*:*:wordpress:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.