CVE-2025-30773: TranslatePress Object Injection Vulnerability

CVE-2025-30773 Overview

CVE-2025-30773 is a PHP Object Injection vulnerability in the Cozmoslabs TranslatePress (translatepress-multilingual) WordPress plugin. The flaw stems from deserialization of untrusted data [CWE-502] and affects all versions up to and including 2.9.6. An authenticated attacker with high privileges can submit crafted serialized payloads that the plugin deserializes, instantiating arbitrary PHP objects within the application context. When suitable gadget chains exist in WordPress core, the active theme, or other installed plugins, the injection can escalate to code execution, file operations, or data tampering.

Critical Impact
Successful exploitation yields high impact to confidentiality, integrity, and availability on the affected WordPress site, with potential for full site compromise when usable POP chains are present.

Affected Products

Cozmoslabs TranslatePress (translatepress-multilingual) versions through 2.9.6
WordPress installations running the vulnerable plugin
Multilingual WordPress sites relying on TranslatePress for translation workflows

Discovery Timeline

2025-03-27 - CVE-2025-30773 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30773

Vulnerability Analysis

The vulnerability is a classic PHP Object Injection caused by passing attacker-influenced input into unserialize() without prior validation. When PHP deserializes a string, it reconstructs object instances and invokes magic methods such as __wakeup(), __destruct(), and __toString() on those objects. An attacker who controls the serialized payload controls which classes are instantiated and which property values are set on those objects.

In the WordPress ecosystem, gadget classes available through core, themes, and other plugins can be chained together to perform unintended actions during object destruction. These property-oriented programming (POP) chains have historically produced arbitrary file deletion, file write, SQL injection, and remote code execution outcomes from a single object injection sink.

The attack requires high privileges, which constrains exploitation to authenticated users with elevated roles such as administrators or editors depending on the affected endpoint. The attack vector is network-based and requires no user interaction.

Root Cause

The root cause is unsafe deserialization of attacker-controlled data within TranslatePress code paths through version 2.9.6. The plugin passes serialized input to PHP's deserialization routine without restricting allowed classes or validating structural integrity, violating the secure coding pattern described in [CWE-502].

Attack Vector

An authenticated attacker submits a crafted serialized PHP payload to a vulnerable TranslatePress endpoint or option storage path. The plugin deserializes the value, instantiating attacker-chosen classes with attacker-chosen properties. Magic methods on those objects then execute gadget logic that can read or write files, manipulate the database, or trigger code execution paths exposed by other installed components.

Technical details and the patched code path are documented in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-30773

Indicators of Compromise

Requests to TranslatePress endpoints containing serialized PHP markers such as O:, a:, or s: followed by class names in POST bodies, cookies, or URL parameters.
Unexpected PHP files, scheduled tasks, or modified wp_options rows appearing shortly after administrative TranslatePress activity.
WordPress error log entries referencing __wakeup, __destruct, or class-not-found errors during translation operations.
New or modified administrator accounts created by privileged sessions interacting with translation settings.

Detection Strategies

Inspect web server and WAF logs for serialized object signatures submitted to TranslatePress URLs under /wp-admin/admin-ajax.php and plugin-specific routes.
Audit installed plugin versions against the fixed release; flag any TranslatePress instance at 2.9.6 or earlier.
Correlate high-privilege authenticated sessions with subsequent filesystem or database changes on the WordPress host.

Monitoring Recommendations

Enable file integrity monitoring on wp-content/, wp-config.php, and the active theme directory.
Forward WordPress, PHP-FPM, and web server logs into a centralized analytics platform for retroactive hunting on serialized payload patterns.
Alert on creation of PHP files in upload directories and on changes to scheduled cron events in wp_options.

How to Mitigate CVE-2025-30773

Immediate Actions Required

Upgrade TranslatePress to a release later than 2.9.6 as identified in the Patchstack advisory.
Rotate credentials for all administrator and editor accounts after patching to invalidate any sessions used during exploitation.
Review installed plugins and themes for known POP gadget chains and remove components that are unused.
Conduct an integrity review of WordPress core files, the database, and uploads directory for signs of tampering.

Patch Information

Cozmoslabs has addressed the deserialization sink in TranslatePress versions after 2.9.6. Refer to the Patchstack Vulnerability Report for the fixed version and patch metadata. Apply the update through the WordPress plugin manager or by deploying the updated package from the vendor.

Workarounds

Restrict TranslatePress administrative endpoints to trusted IP addresses via web server or WAF rules until patching completes.
Deploy WAF signatures that block serialized PHP payloads in requests targeting TranslatePress URLs.
Limit administrator and editor accounts to the minimum required, and enforce multi-factor authentication on all privileged WordPress users.
Disable the TranslatePress plugin on sites that cannot be upgraded immediately.

bash

# Update TranslatePress using WP-CLI
wp plugin update translatepress-multilingual
wp plugin get translatepress-multilingual --field=version