CVE-2025-58218
BaseFortify
Publication date: 2025-08-27
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| enituretechnology | small_package_quotes_usps_edition | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-58218 is a PHP Object Injection vulnerability in the WordPress plugin Small Package Quotes – USPS Edition (versions up to 1.3.9). It allows a malicious actor with administrator privileges to inject malicious objects, potentially leading to attacks such as code injection, SQL injection, path traversal, and denial of service, if a suitable PHP Object Injection POP chain is available. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with administrator access to execute harmful actions like injecting malicious code, manipulating databases via SQL injection, accessing unauthorized files through path traversal, or causing denial of service. These impacts can compromise the security, integrity, and availability of your WordPress site. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying if the affected WordPress plugin "Small Package Quotes – USPS Edition" version 1.3.9 or earlier is installed. Since it requires administrator privileges to exploit and involves PHP Object Injection, scanning for the plugin version is key. Commands to check the plugin version on a WordPress installation could include: 1) Using WP-CLI: `wp plugin list | grep small-package-quotes-usps-edition` to see the installed version. 2) Searching plugin files for version info: `grep -r 'Version' wp-content/plugins/small-package-quotes-usps-edition/`. Additionally, monitoring for unusual PHP object deserialization activity or suspicious requests targeting the plugin endpoints may help, but no specific detection commands are provided in the resources. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update the "Small Package Quotes – USPS Edition" WordPress plugin to version 1.3.10 or later, which contains the fix for this vulnerability. If updating immediately is not possible, applying Patchstack's virtual patching (vPatch) can auto-mitigate the vulnerability. Additionally, restricting administrator privileges and monitoring for suspicious activity is advised. In case of suspected compromise, professional incident response or server-side malware scanning is recommended over plugin-based malware scanners. [1]