CVE-2025-23914 CRITICAL

CVE-2025-23914: WordPress Muzaara Google Ads Report Plugin <= 3.1 - PHP Object Injection vulnerability

Vendor Muzaara

Product Muzaara Google Ads Report

Weakness CWE-502 · Unsafe deserialization

Published January 22, 2025

Last update May 12, 2026

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in muzaara Muzaara Google Ads Report muzaara-adwords-optimize-dashboard allows Object Injection.This issue affects Muzaara Google Ads Report: from n/a through <= 3.1.

Key dates

02Disclosure timeline

January 22, 2025 CVE published

May 12, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-23914 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html

Related vulnerabilities

04Related CVE

CVE-2024-13921 Order Export & Order Import for WooCommerce <= 2.6.0 - Authenticated (Admin+) PHP Object Injection via form_data Parameter CVE-2025-39527 WordPress Rating by BestWebSoft plugin <= 1.7 - PHP Object Injection Vulnerability CVE-2025-54001 WordPress Classter theme <= 2.5 - PHP Object Injection vulnerability CVE-2026-7637 Boost <= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_LOCATION Cookie CVE-2024-47552 Apache Seata (incubating): Deserialization of untrusted Data in jraft mode in Apache Seata Server