CVE-2025-58592

Name of the Vulnerable Software and Affected Versions TranslatePress versions prior to 2.10.3

Description An issue exists where the software allows the deserialization of untrusted data, leading to PHP Object Injection. This occurs when unauthenticated attackers inject a PHP Object via untrusted input. The impact of this issue depends on the presence of a POP (Property-Oriented Programming) chain—a sequence of objects that can be leveraged to execute unintended code—within other installed plugins or themes. If such a chain is present, an attacker could potentially delete arbitrary files, retrieve sensitive data, or execute code.

Recommendations Update to a version newer than 2.10.2.