Wordpress Plugin
CVE-2025-67535
MEDIUM
Severity by source
AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (patchstack) · only source for this CVE.
CVSS VectorVendor: patchstack
Lifecycle Timeline
3DescriptionCVE.org
Deserialization of Untrusted Data vulnerability in Flipper Code - WordPress Development Company WP Maps wp-google-map-plugin allows Object Injection.This issue affects WP Maps: from n/a through <= 4.8.6.
AnalysisAI
Deserialization of untrusted data in WP Maps WordPress plugin versions up to 4.8.6 allows high-privileged authenticated users to inject and instantiate arbitrary PHP objects, potentially leading to code execution or privilege escalation. While the CVSS score of 6.5 reflects high confidentiality and integrity impact, the requirement for administrator-level privileges (PR:H) and user interaction (UI:R) significantly constrains real-world exploitability. EPSS score of 0.04% indicates minimal observed exploitation likelihood despite the vulnerability's technical severity.
Technical ContextAI
WP Maps is a WordPress plugin for embedding Google Maps functionality. The vulnerability stems from unsafe deserialization of PHP objects (CWE-502), likely in plugin settings or data handling routines that reconstruct serialized PHP objects without validation. Attackers with administrative credentials can craft malicious serialized objects that, when unserialized, trigger PHP magic methods (__wakeup, __destruct, etc.) to execute arbitrary code through gadget chains. The local attack vector (AV:L) indicates the attack must originate from the WordPress admin dashboard or a similarly privileged context, not from unauthenticated remote access.
Affected ProductsAI
WP Maps (wp-google-map-plugin) by Flipper Code versions from an unspecified baseline through version 4.8.6 inclusive. The exact affected version range lower bound is not clearly documented in available data. Additional CPE identification for this WordPress plugin may be available through the Patchstack database referenced in the NVD entry.
RemediationAI
Update WP Maps to a patched version released after 4.8.6; exact patched version number is not provided in available references. Immediately review WordPress user accounts and revoke administrative privileges from unnecessary or untrusted users. Audit serialized object handling in custom WordPress code and plugins, and consider implementing PHP object filters via security plugins. See Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/wp-google-map-plugin/vulnerability/wordpress-wp-maps-plugin-4-8-6-php-object-injection-vulnerability?_s_id=cve) for vendor patch availability and detailed remediation guidance.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-502 – Deserialization of Untrusted Data
View allSame technique Deserialization
View allShare
External POC / Exploit Code
Leaving vuln.today