What is the CVSS score of CVE-2025-15672?

CVE-2025-15672 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of ChamaWP Plugin are affected by CVE-2025-15672?

The ChamaWP WordPress plugin before version 1.0.13 contains an unsafe deserialization vulnerability enabling unauthenticated remote code execution on affected installations.. A patch is available.

Is there a public PoC exploit available for CVE-2025-15672?

Yes, a public proof-of-concept exploit is available for CVE-2025-15672. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2025-15672?

Within 24 hours, inventory all WordPress installations and identify those running ChamaWP; prioritize instances in production or handling sensitive data. Within 7 days, update all affected ChamaWP installations to version 1.0.13 or later, beginning with high-criticality systems; verify successful updates in staging environments first if available. Within 30 days, conduct post-patch verification across all WordPress instances to confirm ChamaWP is updated, review WordPress access logs for exploitation attempts between now and the patch date, and implement Web Application Firewall (WAF) rules to block known deserialization attack patterns as a compensating measure for any instances that cannot be immediately patched.

ChamaWP Plugin CVE-2025-15672

EUVD-2025-210596 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-08-03 WPScan

GHSA-w2rh-rmh8-jmwq

WordPress RCE PHP Deserialization Chamawp

8.1

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network vector with no auth or interaction required, but AC:H reflects mandatory gadget chain dependency; full CIA impact conditional on chain availability.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 18:23 vuln.today

CVSS changed

Aug 04, 2026 - 18:22 NVD

8.1 (HIGH)

Patch available

Aug 03, 2026 - 07:01 EUVD

CVE Published

Aug 03, 2026 - 06:00 cve.org

HIGH 8.1

CVE Published

Aug 03, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other installed code.

AnalysisAI

PHP object injection via unsafe deserialization in the ChamaWP WordPress plugin (versions before 1.0.13) enables unauthenticated network attackers to achieve remote code execution, contingent on the presence of a suitable gadget chain within the broader WordPress installation. The CVSS vector (PR:N, UI:N) confirms no authentication or user interaction is required, though the AC:H rating reflects the dependency on exploitable gadget chains from co-installed plugins or libraries. A public proof-of-concept exists per WPScan, with EPSS at 0.22% (13th percentile), indicating low current automated exploitation activity despite code availability - this suggests targeted rather than widespread opportunistic exploitation at time of analysis.

Technical ContextAI

CWE-502 (Deserialization of Untrusted Data) is the root cause: the plugin passes user-controlled input directly to PHP's unserialize() without sanitization or type validation. PHP deserialization is a well-understood attack class where injecting a crafted serialized object triggers magic methods (__wakeup, __destruct, __toString) on classes already loaded in the PHP process. The critical dependency is a 'gadget chain' - a sequence of class method calls achievable through classes present in WordPress core, co-installed plugins, or themes that, when chained, produce a dangerous side effect (file write, code eval, system command). The CPE (cpe:2.3:a:unknown:chamawp:*:*:*:*:*:*:*:*) with vendor listed as 'unknown' suggests limited NVD enrichment; affected versions are confirmed as ChamaWP < 1.0.13 per EUVD and WPScan data. The attack surface is any input parameter accepted by the plugin before 1.0.13 that flows into unserialize().

RemediationAI

Update ChamaWP to version 1.0.13 or later, which introduces proper input validation before deserialization. The patch is confirmed available from the vendor per intelligence data; retrieve it from the WordPress plugin repository or the WPScan advisory at https://wpscan.com/vulnerability/8fcef037-db68-4595-be86-be3bf315c385/. If immediate upgrade is not possible, disabling or deactivating the ChamaWP plugin entirely is the most effective compensating control, as it eliminates the attack surface without requiring configuration changes - note this will disable all plugin functionality. As a secondary measure, a Web Application Firewall rule blocking serialized PHP object patterns (strings beginning with 'O:' or 'a:' in user-controlled parameters) may reduce automated exploitation attempts, but this is bypassable by determined attackers and should not substitute for patching. Audit co-installed plugins for known gadget chain sources (particularly those using Guzzle, Monolog, or Symfony components) to assess composite risk in the interim.