BaseFortify

Publication date: 2025-10-22

Last updated on: 2026-04-01

Assigner: Patchstack

Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Sayan Datta WP Last Modified Info wp-last-modified-info allows Remote Code Inclusion.This issue affects WP Last Modified Info: from n/a through <= 1.9.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-22

Last Modified

2026-04-01

Generated

2026-07-06

AI Q&A

2025-10-22

EPSS Evaluated

2026-07-05

NVD

CVE-2025-52756

Affected Vendors & Products

Vendor	Product	Version / Range
sayan_datta	wp_last_modified_info	1.9.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability is an Improper Control of Generation of Code, also known as Code Injection, in the WP Last Modified Info plugin by Sayan Datta. It allows an attacker to perform Remote Code Inclusion, meaning they can inject and execute malicious code remotely through the plugin versions up to 1.9.2.

Impact Analysis

This vulnerability can allow attackers to execute arbitrary code on your system remotely, potentially leading to unauthorized access, data theft, system compromise, or further exploitation of your environment.

Hi! I’m here to help you understand CVE-2025-52756. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70