CVE-2025-30949

The vulnerability exploits PHP's native deserialization mechanism (unserialize() function) applied to untrusted input. CWE-502 (Deserialization of Untrusted Data) is the root cause. When user-controlled data is passed directly to unserialize() without validation, an attacker can craft a malicious serialized PHP object. Upon deserialization, if the application has access to gadget chains (common methods in loaded classes that chain together to execute code), the attacker achieves arbitrary object instantiation and method invocation. The Site Chat on Telegram plugin, a WordPress plugin for integrating Telegram messaging, likely deserializes user input in its chat handling or configuration routines without proper sanitization. CWE-502 is particularly dangerous in PHP environments where magic methods like __wakeup(), __destruct(), and __toString() can be chained to bypass normal object initialization controls.