PHP Object Injection Vulnerability in PGS Core Plugin for WordPress
CVE-2025-0855

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Pgs Core
Vendor
CVE Published:
6 May 2025

What is CVE-2025-0855?

The PGS Core plugin for WordPress contains a vulnerability that allows for PHP Object Injection through insecure deserialization of untrusted input in the 'import_header' function. This flaw enables unauthenticated attackers to potentially inject PHP objects, which may lead to various consequences such as file deletion, sensitive data exposure, or arbitrary code execution. The severity of this flaw can be amplified if additional plugins or themes that contain a PHP Object Probing (POP) chain are also present on the WordPress installation, which could further compromise the system.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

PGS Core * <= 5.8.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://docs.potenzaglobalsolutions.com/docs/ciyashop-wp/...

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

István Márton
JSON
.