CVE-2025-30773

The TranslatePress WordPress plugin contains a vulnerability that allows attackers with administrator-level access and above to inject malicious PHP objects into the application by exploiting deserialization of untrusted input in versions up to 2.9.6. This flaw enables potential exploitation of additional vulnerabilities present on the system, such as the ability to delete arbitrary files or retrieve sensitive data, if a specific chain of vulnerabilities is also present.

Based on public CVE data (MITRE/NVD).