Platform
wordpress
Component
ocean-modal-window
Fixed in
2.3.3
2.3.3
CVE-2025-13307 is a Remote Code Execution (RCE) vulnerability affecting the Ocean Modal Window plugin for WordPress. This vulnerability allows authenticated attackers, specifically those with Editor-level access or higher, to execute arbitrary code on the server. The vulnerability impacts versions up to and including 2.3.2. A patch has been released in version 2.3.3.
Successful exploitation of CVE-2025-13307 grants an attacker complete control over the affected WordPress server. An authenticated attacker with Editor privileges can upload and execute malicious code, leading to data breaches, website defacement, malware installation, and potential compromise of the entire network. The impact is significant, as it bypasses standard WordPress security measures and allows for persistent, high-impact attacks. This vulnerability shares similarities with other WordPress plugin vulnerabilities where insufficient input validation allows for code injection.
CVE-2025-13307 was publicly disclosed on 2025-11-28. While no active exploitation campaigns have been confirmed, the ease of exploitation and the plugin's popularity suggest a potential for widespread attacks. Public proof-of-concept (POC) code is likely to emerge, increasing the risk. This CVE is not currently listed on CISA KEV.
Exploit Status
EPSS
0.35% (57% percentile)
CVSS Vector
The primary mitigation for CVE-2025-13307 is to immediately upgrade the Ocean Modal Window plugin to version 2.3.3 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider restricting access to the WordPress admin panel to only trusted users. Implementing a Web Application Firewall (WAF) with rules to detect and block suspicious code execution attempts can provide an additional layer of defense. Regularly scan your WordPress installation for vulnerabilities using a reputable security plugin.
Update to version 2.3.3, or a newer patched version
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-13307 is a Remote Code Execution vulnerability in the Ocean Modal Window WordPress plugin, allowing authenticated attackers to execute code on the server.
You are affected if you are using Ocean Modal Window version 2.3.2 or earlier. Check your plugin version and upgrade immediately.
Upgrade the Ocean Modal Window plugin to version 2.3.3 or later to patch the vulnerability.
While no active exploitation campaigns have been confirmed, the vulnerability's ease of exploitation suggests a potential for attacks.
Refer to the plugin developer's website or WordPress plugin repository for the official advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.