CVE-2025-2332

Summary

CVE-2025-2332 is a vulnerability affecting the Export All Posts, Products, Orders, Refunds & Users plugin for WordPress. This issue allows unauthenticated attackers to inject PHP Objects through deserialization of untrusted input in the 'returnMetaValueAsCustomerInput' function. The vulnerability itself does not enable attackers to perform significant actions, but becomes dangerous if a POP (Return-Oriented Programming) chain exists in an additional plugin or theme installed on the target system. If exploited, the attacker could potentially delete files, retrieve sensitive data, or execute code based on the available POP chain.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.