CVE-2025-52756 HIGH

CVE-2025-52756: WordPress WP Last Modified Info plugin <= 1.9.4 - Remote Code Execution (RCE) vulnerability

Vendor Sayan Datta
Product WP Last Modified Info
Weakness CWE-94 · Code injection
Published October 22, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Improper Control of Generation of Code ('Code Injection') vulnerability in Sayan Datta WP Last Modified Info wp-last-modified-info allows Remote Code Inclusion.This issue affects WP Last Modified Info: from n/a through <= 1.9.4.

Explanation of Vulnerability in Simple Terms

02Summary

WP Last Modified Info versions 1.9.4 and earlier contain a code injection vulnerability. An authenticated user with low privileges can inject and execute arbitrary code on the site by manipulating plugin input. The vulnerability affects confidentiality, integrity, and availability. Site administrators should update to a version newer than 1.9.4.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the site with the privileges of the authenticated user.

Potential impact on your site

04Site Impact

A low-privilege user account can be compromised to execute malicious code, potentially compromising the entire site.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege user account (e.g., subscriber or contributor role).

Key dates

06Disclosure timeline

October 22, 2025 CVE published
April 28, 2026 Record updated