CVE-2025-48140 Overview
CVE-2025-48140 is a code injection vulnerability affecting the MetalpriceAPI WordPress plugin through version 1.1.4. The flaw allows authenticated attackers with low privileges to execute arbitrary code on the underlying server. The vulnerability is classified under CWE-94: Improper Control of Generation of Code and results in remote code execution (RCE).
The issue affects all versions of MetalpriceAPI up to and including 1.1.4. Exploitation requires network access and low-level authentication but no user interaction, and the impact crosses security boundaries between the plugin and the hosting environment.
Critical Impact
Authenticated attackers can execute arbitrary code remotely, leading to full compromise of WordPress sites running vulnerable versions of the MetalpriceAPI plugin.
Affected Products
- MetalpriceAPI WordPress plugin versions through 1.1.4
- WordPress installations with the MetalpriceAPI plugin enabled
- Web servers hosting affected WordPress deployments
Discovery Timeline
- 2025-06-09 - CVE-2025-48140 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-48140
Vulnerability Analysis
The MetalpriceAPI plugin fails to properly control the generation of code from user-supplied input. This weakness corresponds to CWE-94: Improper Control of Generation of Code, commonly referred to as code injection. An attacker with at least low-privilege authentication on a WordPress site can submit crafted input that the plugin incorporates into executable code paths.
Because the scope changes during exploitation, the attacker can affect resources beyond the plugin itself. Successful exploitation impacts confidentiality, integrity, and availability of the host system. The EPSS score stands at 0.29% with a percentile of 52.5, indicating moderate exploitation likelihood in the near term.
Root Cause
The root cause is missing or insufficient validation and sanitization of user-controlled input that is later evaluated as code by the PHP runtime. When the plugin processes input destined for dynamic code constructs such as eval(), create_function(), or other dynamic dispatch mechanisms, attacker-supplied payloads execute in the context of the web server process.
Attack Vector
The attack vector is network-based and requires only low privileges, such as a subscriber or contributor account on the target WordPress site. The attacker submits a request containing a malicious payload to a vulnerable plugin endpoint. The plugin then evaluates the payload as PHP code, executing arbitrary commands with the privileges of the web server user.
No verified proof-of-concept code is publicly available. Refer to the Patchstack WordPress Vulnerability advisory for additional technical context.
Detection Methods for CVE-2025-48140
Indicators of Compromise
- Unexpected PHP files or webshells appearing in the WordPress wp-content/plugins/metalpriceapi/ directory or other plugin directories
- Outbound network connections from the web server to unknown hosts following requests to MetalpriceAPI endpoints
- WordPress audit log entries showing low-privilege accounts triggering plugin functionality immediately before suspicious server activity
- New or modified WordPress administrator accounts created without authorization
Detection Strategies
- Monitor HTTP request logs for unusual payloads sent to MetalpriceAPI plugin endpoints, including PHP code fragments or serialized objects
- Inspect web server process trees for unexpected child processes spawned by the PHP-FPM or Apache worker processes
- Deploy file integrity monitoring across WordPress installation directories to detect unauthorized file modifications
- Correlate authentication events with plugin activity to identify low-privilege accounts performing administrator-level actions
Monitoring Recommendations
- Enable verbose logging on the WordPress site, including plugin-level debug logs where available
- Forward web server access logs and PHP error logs to a centralized log management or SIEM platform for analysis
- Set up alerts for command execution patterns originating from the web server user account
- Track WordPress plugin inventory across the environment to identify hosts running MetalpriceAPI version 1.1.4 or earlier
How to Mitigate CVE-2025-48140
Immediate Actions Required
- Disable the MetalpriceAPI plugin on all WordPress sites until a patched version is confirmed installed
- Audit all WordPress user accounts and revoke unnecessary privileges, especially for low-trust roles
- Review web server and WordPress logs for indicators of prior exploitation attempts
- Restrict network access to the WordPress administration interface using IP allowlisting where feasible
Patch Information
No patched version is identified in the available CVE data beyond confirmation that versions through 1.1.4 are vulnerable. Site administrators should consult the Patchstack WordPress Vulnerability advisory for the latest remediation guidance and update the plugin to the fixed release when available.
Workarounds
- Deactivate and remove the MetalpriceAPI plugin entirely if business requirements do not mandate its use
- Deploy a Web Application Firewall (WAF) rule to block requests containing PHP code patterns directed at plugin endpoints
- Apply the principle of least privilege to WordPress accounts, removing contributor and higher roles from untrusted users
- Isolate the WordPress host using network segmentation to limit lateral movement if exploitation occurs
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
