CVE-2025-30773

Executive Summary

CVE-2025-30773 is a critical deserialization of untrusted data vulnerability (CWE-502) affecting the TranslatePress plugin (slug: translatepress-multilingual) by Cozmoslabs, a WordPress ecosystem component. This vulnerability allows unauthenticated attackers to perform Object Injection via deserialization of untrusted data, potentially leading to remote code execution (RCE), data exfiltration, or complete site compromise. The vulnerability affects all versions up to and including 2.9.6. As of this report, no official patch has been released, and no public proof-of-concept (PoC) or exploit code is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the high CVSS score (7.2) and the nature of deserialization flaws demand immediate attention.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and can be installed directly from the WordPress admin dashboard or via manual upload. Since no patch is available, site administrators must consider temporary mitigations such as disabling the plugin or implementing web application firewall (WAF) rules. The lack of a patch increases supply chain risk, as attackers may target unpatched sites through automated scanning.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.2 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full data access possible.
• Integrity Impact: High (I:H) – Full control over data.
• Availability Impact: High (A:H) – Potential for denial of service.

Threat Level: Critical. Deserialization vulnerabilities in PHP applications often lead to complete server compromise. The lack of a patch and the plugin’s popularity (over 100,000 active installations) make this a high-priority target for threat actors.

Deep Dive & Mechanics

The vulnerability resides in the TranslatePress plugin’s handling of serialized PHP objects. The plugin likely uses unserialize() on user-supplied input without proper validation or sanitization. In PHP, unserialize() automatically reconstructs objects from a serialized string, and if the input is attacker-controlled, they can inject arbitrary objects that trigger magic methods (e.g., __wakeup(), __destruct(), __toString()). This can lead to arbitrary code execution if a gadget chain exists within the plugin or WordPress core.

The vulnerable code path is likely in a function that processes translation data, such as importing/exporting translation files or handling AJAX requests. The attacker can craft a malicious serialized payload and send it via HTTP POST/GET parameters. Since no authentication is required, any unauthenticated visitor can trigger the vulnerability.

Attack Flow:

1. Attacker identifies a WordPress site running TranslatePress <= 2.9.6.
2. Attacker crafts a serialized PHP object containing a gadget chain (e.g., using known WordPress or plugin classes).
3. Attacker sends the payload to a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=trp_import_translation).
4. The plugin calls unserialize() on the payload, triggering the gadget chain.
5. The attacker achieves remote code execution, data exfiltration, or site takeover.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code pattern. A typical vulnerable snippet might look like:

// Vulnerable code (hypothetical)
$data = $_POST['translation_data'];
$translations = unserialize(stripslashes($data));

A patched version would replace unserialize() with a safe alternative, such as json_decode() or use a whitelist of allowed classes:

// Patched code (hypothetical)
$data = $_POST['translation_data'];
$translations = json_decode(stripslashes($data), true);

Or, if serialization is required, use unserialize() with a class whitelist:

// Patched code with allowed classes
$allowed_classes = ['AllowedClass1', 'AllowedClass2'];
$translations = unserialize($data, ['allowed_classes' => $allowed_classes]);

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

1. Install WordPress with TranslatePress plugin version 2.9.6.
2. Identify the vulnerable endpoint (e.g., via code review or fuzzing).
3. Craft a serialized payload using PHPGGC (PHP Generic Gadget Chains) or manual gadget chain.

Exploitation Steps:

1. Use PHPGGC to generate a payload for a known WordPress gadget chain:

   phpggc WordPress/RCE1 system 'id' | base64
   

2. Send the payload to the vulnerable endpoint:

   curl -X POST http://target/wp-admin/admin-ajax.php \
     -d "action=trp_import_translation&data=$(phpggc WordPress/RCE1 system 'id' | base64 -w0)"
   

3. Verify execution by checking for the output of the id command in the response or logs.

Note: Since no public PoC exists, this is a hypothetical exploitation scenario. Actual exploitation may require custom gadget chain development.

Blue Team (Defender)

Detection Steps:

1. Monitor for unusual serialized PHP objects in HTTP requests (e.g., strings starting with O:, a:, C:).
2. Enable logging of all unserialize() calls via PHP error logs or custom WAF rules.
3. Use the detection rules provided below.

Mitigation:

• Disable the TranslatePress plugin until a patch is released.
• Implement a WAF rule to block requests containing serialized PHP objects.
• Restrict access to AJAX endpoints using IP whitelisting or authentication.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing serialized PHP objects (e.g., O:10:"WP_Post":1:{s:4:"data";s:5:"hello";}).
  • Requests to /wp-admin/admin-ajax.php with suspicious action parameters (e.g., trp_import_translation).
  • Base64-encoded payloads in POST data.

• File IOCs:

  • Unexpected files in the WordPress uploads directory (e.g., webshells).
  • Modified plugin files (e.g., translatepress-multilingual/index.php).

• System IOCs:

  • Unusual PHP error logs containing unserialize() errors.
  • New user accounts with administrative privileges.
  • Outbound connections to known C2 servers.

Detection Engineering

YARA Rule

rule CVE_2025_30773_TranslatePress_Deserialization {
    meta:
        description = "Detects serialized PHP objects in HTTP requests targeting TranslatePress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-30773"
        severity = "critical"

    strings:
        $serialized = /O:\d+:"[^"]+":\d+:\{/
        $action = "trp_import_translation"
        $ajax = "admin-ajax.php"

    condition:
        $ajax and $action and $serialized
}

Sigma Rule

title: CVE-2025-30773 - TranslatePress Deserialization Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests containing serialized PHP objects targeting TranslatePress plugin
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-30773
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=trp_import_translation'
        cs-body|re: 'O:\d+:"[^"]+":\d+:\{'
    condition: selection
falsepositives:
    - Legitimate plugin functionality (rare)
level: critical

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-30773 - TranslatePress Deserialization Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=trp_import_translation"; http_client_body;
    pcre:"/O:\d+:\"[^\"]+\":\d+:\{/R";
    sid:10000001;
    rev:1;
    reference:cve,2025-30773;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the TranslatePress plugin until a patch is released.
2. Implement a WAF rule to block requests containing serialized PHP objects (e.g., ModSecurity rule).
3. Monitor logs for exploitation attempts using the Sigma/Suricata rules above.

Long-term Actions:

1. Apply the official patch once released by Cozmoslabs.
2. Update the plugin to the latest version (if a patched version becomes available).
3. Conduct a security audit of all WordPress plugins for similar deserialization vulnerabilities.
4. Use a PHP security scanner (e.g., RIPS, WPScan) to identify vulnerable code.

Workaround:

• If the plugin cannot be disabled, restrict access to AJAX endpoints via .htaccess:

  <Files "admin-ajax.php">
      Require ip 192.168.1.0/24
  </Files>
  

Valters IT
Securing Digital Frontiers