High · published December 13, 2025
⚡ Hold onto your WordPress sites! The Doubly – Cross Domain Copy Paste plugin allows authenticated attackers to inject PHP Objects simply through a ZIP upload. 😱 Think of this vulnerability like a sneaky food critic 🥘 who gains access to the kitchen with just a chef's hat on. With their limited badge, they can mix ingredients in ways that could spoil the whole dish! An attacker with Subscriber-level access can inject malicious code into your server, leading to devastating outcomes like deleting files or harvesting sensitive data. If administrators mistakenly enable this access, the kitchen becomes an open buffet for any malicious actor!
Think of this vulnerability like a sneaky food critic 🥘 who gains access to the kitchen with just a chef's hat on. With their limited badge, they can mix ingredients in ways that could spoil the whole dish! This vulnerability revolves around PHP Object Injection caused by deserialization of untrusted input from the content.txt file within uploaded ZIP archives. It opens a door for attackers to execute arbitrary code, especially when specific PHP gadgets are available on the server.
An attacker with Subscriber-level access can inject malicious code into your server, leading to devastating outcomes like deleting files or harvesting sensitive data. If administrators mistakenly enable this access, the kitchen becomes an open buffet for any malicious actor! To safeguard your site, immediately update the Doubly – Cross Domain Copy Paste plugin to version 1.0.47 or higher. Additionally, consider tightening user permissions to limit who can upload ZIP files until you are certain your site is secure. You've got this! Follow these steps, and you'll fortify your WordPress site against this sneaky threat! 🛡️