CVE-2025-53465 HIGH

CVE-2025-53465: WordPress GSheets Connector Plugin <= 1.1.1 - PHP Object Injection Vulnerability

Vendor Raoinfotech
Product GSheets Connector
Weakness CWE-502 · Unsafe deserialization
Published September 22, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in raoinfotech GSheets Connector sheetlink allows Object Injection.This issue affects GSheets Connector: from n/a through <= 1.1.1.

Explanation of Vulnerability in Simple Terms

02Summary

GSheets Connector versions 1.1.1 and earlier contain a deserialization vulnerability that allows authenticated administrators to execute arbitrary code on the site. An attacker with high-level privileges can craft malicious serialized data that, when processed by the plugin, runs their own PHP code. This requires administrative access to exploit.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the site with the privileges of the web server.

Potential impact on your site

04Site Impact

A compromised admin account can lead to full site takeover, data theft, or malware installation.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrative access to the site.

Key dates

06Disclosure timeline

September 22, 2025 CVE published
April 28, 2026 Record updated