WP Webhooks CVE-2025-66073
HIGHSeverity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
6DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in Cozmoslabs WP Webhooks wp-webhooks allows Object Injection.This issue affects WP Webhooks: from n/a through <= 3.3.8.
AnalysisAI
PHP object injection in WP Webhooks plugin versions through 3.3.8 allows authenticated administrators to execute arbitrary code through unsafe deserialization of untrusted data. Exploitation requires high-privilege WordPress admin access but achieves complete system compromise once triggered. EPSS score of 0.09% indicates low observed exploitation despite network-reachable attack vector, likely due to the elevated privilege requirement limiting real-world opportunities.
Technical ContextAI
This vulnerability exploits PHP's unserialize() function when processing untrusted input, a CWE-502 class flaw common in WordPress plugins handling webhook payloads or configuration data. When an attacker-controlled serialized string containing malicious object definitions is deserialized, PHP automatically invokes magic methods like __wakeup() or __destruct(), enabling arbitrary code execution through object injection gadget chains. WP Webhooks processes external data through webhook endpoints and configuration interfaces, creating multiple deserialization attack surfaces. The plugin's architecture allows high-privilege users to manipulate serialized data stores without proper validation, trusting administrator input despite WordPress's principle that admins may be compromised through session hijacking, credential stuffing, or supply chain attacks.
Affected ProductsAI
WordPress WP Webhooks plugin versions from earliest releases through 3.3.8 inclusive are confirmed vulnerable per Patchstack advisory. The vulnerability affects all WordPress installations running these plugin versions regardless of underlying PHP or WordPress core version, as the deserialization flaw exists in plugin code independent of the host environment. Vendor advisory available at https://patchstack.com/database/Wordpress/Plugin/wp-webhooks/vulnerability/wordpress-wp-webhooks-plugin-3-3-8-php-object-injection-vulnerability provides full technical details and confirmation of affected version range.
RemediationAI
Upgrade WP Webhooks to version 3.3.9 or later, which addresses the unsafe deserialization vulnerability through input validation and sanitization of serialized data. No workaround exists that fully eliminates risk while retaining plugin functionality. For environments unable to immediately patch, implement the following compensating controls with noted trade-offs: Restrict WordPress admin dashboard access to IP allowlists (reduces attack surface but breaks remote admin workflows), enforce multi-factor authentication for all admin accounts (mitigates credential compromise but adds user friction), disable the WP Webhooks plugin entirely until patching (eliminates risk but removes webhook functionality), and monitor WordPress admin audit logs for unexpected plugin configuration changes or webhook creation by unfamiliar accounts (detection-only control, does not prevent exploitation). Full advisory and patch information at https://patchstack.com/database/Wordpress/Plugin/wp-webhooks/vulnerability/wordpress-wp-webhooks-plugin-3-3-8-php-object-injection-vulnerability.
Share
External POC / Exploit Code
Leaving vuln.today