CVE-2025-15672

Name of the Vulnerable Software and Affected Versions ChamaWP versions prior to 1.0.13

Description Insufficient validation of user input before it is processed by a PHP deserialization function allows unauthenticated attackers to inject arbitrary PHP objects. This can lead to remote code execution if a suitable gadget chain—a sequence of existing code fragments that can be leveraged for malicious purposes—is present within the installed environment.

Recommendations Update ChamaWP to version 1.0.13 or later.