The vulnerability CVE-2025-53243 in the emarket-design Employee Directory – Staff Listing & Team Directory Plugin for WordPress arises from deserialization of untrusted data, which allows an attacker to perform object injection. This can potentially lead to remote code execution or other severe impacts on the affected system. The issue affects all plugin versions up to 4.5.5. The CVSS 3.1 score of 8.1 reflects a network exploitable vulnerability with high impact on confidentiality, integrity, and availability, and no need for privileges or user interaction. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to inject malicious objects via deserialization, potentially leading to full compromise of the affected WordPress site, including unauthorized data access, modification, or denial of service. The high CVSS score indicates critical impacts on confidentiality, integrity, and availability. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the affected plugin to prevent exploitation. Monitor official channels for updates from emarket-design regarding patches or mitigations.