CVE-2025-46481 HIGH

CVE-2025-46481: WordPress Flickr Shortcode Importer plugin <= 2.2.3 - PHP Object Injection Vulnerability

Vendor Michael Cannon
Product Flickr Shortcode Importer
Weakness CWE-502 · Unsafe deserialization
Published April 24, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in Michael Cannon Flickr Shortcode Importer flickr-shortcode-importer allows Object Injection.This issue affects Flickr Shortcode Importer: from n/a through <= 2.2.3.

Explanation of Vulnerability in Simple Terms

02Summary

The Flickr Shortcode Importer plugin for WordPress contains a deserialization vulnerability in versions up to 2.2.3. An authenticated administrator can supply malicious serialized data that the plugin will deserialize without validation, potentially allowing them to execute arbitrary code on the site. This requires high-level access but poses a significant risk to site integrity.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the site with the privileges of the web server.

Potential impact on your site

04Site Impact

A compromised admin account could lead to full site takeover, data theft, or malware installation.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to the WordPress site.

Key dates

06Disclosure timeline

April 24, 2025 CVE published
April 28, 2026 Record updated