CVE-2025-0724

Summary

CVE-2025-0724 is a vulnerability affecting the ProfileGrid plugin for WordPress, which allows authenticated attackers with Subscriber-level access or higher to inject PHP Objects through deserialization of untrusted input in the get_user_meta_fields_html function. This vulnerability does not pose a significant threat in isolation, but if a POP (Return-Oriented Programming) chain exists in another plugin or theme on the target system, it may enable the attacker to execute arbitrary code, delete files, or steal sensitive information. The vulnerable plugin versions include all those up to and including 5.9.4.5.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.