CVE-2025-39527: 
WordPress vulnerability analysis and mitigation

A Deserialization of Untrusted Data vulnerability (CVE-2025-39527) was discovered in Rating by BestWebSoft WordPress plugin affecting versions through 1.7. The vulnerability was disclosed on April 17, 2025, and was reported by security researcher Le Ngoc Anh (Patchstack).

The vulnerability is classified as a PHP Object Injection issue with a CVSS v3.1 score of 8.8 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is tracked under CWE-502 (Deserialization of Untrusted Data) and requires Subscriber level privileges or higher to exploit (Patchstack).

This vulnerability could potentially allow a malicious actor to execute code injection, SQL injection, path traversal, or denial of service attacks if a proper POP chain is present. The specific impact varies case by case, but the high CVSS score indicates significant potential for damage (Patchstack).

As of the disclosure date, no official fix is available for this vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until an official fix becomes available (Patchstack).