CVE-2025-68047
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-04-01
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| patchstack | wp-event-solution | to 4.1.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-502 | The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-68047 is a PHP Object Injection vulnerability in the WordPress Eventin Plugin (versions up to and including 4.1.1). It occurs due to deserialization of untrusted data, allowing a malicious actor to inject PHP objects. This can lead to severe attacks such as code injection, SQL injection, path traversal, and denial of service if a suitable Property Oriented Programming (POP) chain is available. Exploitation requires the attacker to have at least Contributor or Developer privileges within the WordPress environment. [1]
How can this vulnerability impact me? :
This vulnerability can allow attackers with Contributor or Developer privileges to perform PHP Object Injection, potentially leading to code injection, SQL injection, path traversal, and denial of service attacks. These impacts can compromise the security, integrity, and availability of your WordPress site using the Eventin plugin. [1]
What immediate steps should I take to mitigate this vulnerability?
Apply the mitigation rule issued by Patchstack immediately to block attacks targeting this vulnerability until an official patch is released. Users should ensure that no users with Contributor or Developer privileges are exposed to exploitation risks. Monitoring and restricting user privileges can also help reduce risk. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided about detection commands or network/system detection methods for this vulnerability. However, Patchstack has issued a mitigation rule to block attacks targeting this flaw until an official patch is released. Users are advised to apply this mitigation immediately. For detection, monitoring for unusual PHP object injection attempts or suspicious activity related to the Eventin plugin versions up to 4.1.1 may help, but no exact commands are provided. [1]