CVE-2025-60245

Name of the Vulnerable Software and Affected Versions WP User Manager versions prior to 2.9.13

Description The software is susceptible to PHP Object Injection due to the deserialization of untrusted data. This allows authenticated attackers with subscriber-level access or higher to inject a PHP Object. While no native POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) is present in the software, the presence of a POP chain in other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Recommendations Update to a version newer than 2.9.12.