CVE-2025-15672CWE-502insecure-deserialization

CVE-2025-15672

High · published August 3, 2026

CVSS v3.1

8.1

EPSS

Percentile

50.3

In the wild

Unconfirmed

What it is

The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other installed code.

The record

Technical detail

CVSS v3.1: 8.1 · HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0: Not supplied
EPSS: 0.00646 · 50.3th percentile
Weakness: CWE-502 · Deserialization of Untrusted Data
Published: 2026-08-03T11:16Z

References (1)

https://wpscan.com/vulnerability/8fcef037-db68-4595-be86-be3bf315c385/ · [email protected]

EPSS history

Timeline

03 AUG 06:00Z
Chama < 1.0.13 - Unauthenticated PHP Object Injection
cvelistv5