CVE-2025-53577 CRITICAL

CVE-2025-53577: WordPress Global DNS Plugin <= 3.1.0 - Remote Code Execution (RCE) Vulnerability

Vendor Thehp
Product Global DNS
Weakness CWE-94 · Code injection
Published August 20, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Control of Generation of Code ('Code Injection') vulnerability in thehp Global DNS global-dns allows Remote Code Inclusion.This issue affects Global DNS: from n/a through <= 3.1.0.

Explanation of Vulnerability in Simple Terms

02Summary

Global DNS versions 3.1.0 and earlier contain a code injection vulnerability that allows unauthenticated attackers to run arbitrary code on affected systems over the network without user interaction. The vulnerability affects the entire system scope due to the high integrity and availability impact. Immediate patching is critical.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the server without authentication or user interaction.

Potential impact on your site

04Site Impact

Complete system compromise: attackers can execute code, modify data, and disrupt service availability.

Conditions required to exploit

05Prerequisites

Network access to the affected Global DNS instance; no authentication required.

Key dates

06Disclosure timeline

August 20, 2025 CVE published
April 28, 2026 Record updated