PHP Object Injection Vulnerability in PGS Core Plugin for WordPress

CVE-2025-0855

What is CVE-2025-0855?

The PGS Core plugin for WordPress contains a vulnerability that allows for PHP Object Injection through insecure deserialization of untrusted input in the 'import_header' function. This flaw enables unauthenticated attackers to potentially inject PHP objects, which may lead to various consequences such as file deletion, sensitive data exposure, or arbitrary code execution. The severity of this flaw can be amplified if additional plugins or themes that contain a PHP Object Probing (POP) chain are also present on the WordPress installation, which could further compromise the system.

References