CVE-2025-54053 MEDIUM

CVE-2025-54053: WordPress Groundhogg plugin <= 4.2.2 - PHP Object Injection vulnerability

Vendor Adrian Tobey

Product Groundhogg

Weakness CWE-502 · Unsafe deserialization

Published August 20, 2025

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

6.6/10

Attack vector Network

Attack complexity High

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Deserialization of Untrusted Data vulnerability in Adrian Tobey Groundhogg groundhogg allows Object Injection.This issue affects Groundhogg: from n/a through <= 4.2.2.

Explanation of Vulnerability in Simple Terms

02Summary

Groundhogg versions up to 4.2.2 contain a deserialization vulnerability in how they process untrusted data. An authenticated administrator can craft malicious serialized objects that execute arbitrary code when deserialized. This requires high-level access and careful attack construction, but successful exploitation grants full control over the site.

What an attacker can do

03Attacker Capabilities

Run arbitrary code on the site with the privileges of the web server.

Potential impact on your site

04Site Impact

A compromised admin account can lead to complete site takeover, data theft, or malware installation.

Conditions required to exploit

05Prerequisites

Attacker must have administrator-level access to Groundhogg and craft a specially formatted payload.

Key dates

06Disclosure timeline

August 20, 2025 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-54053 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/502.html AskarLabs — CWE-502 write-up Deserialization of Untrusted Data

Related vulnerabilities