PHP Object Injection in Doubly – Cross Domain Copy Paste for WordPress Plugin

CVE-2025-14476

What is CVE-2025-14476?

The Doubly – Cross Domain Copy Paste plugin for WordPress is susceptible to a PHP Object Injection vulnerability, affecting all versions up to 1.0.46. This flaw arises from the deserialization of untrusted input found in the content.txt file within uploaded ZIP archives. Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability to inject PHP objects. This may lead to the execution of arbitrary code, file deletions, or the retrieval of sensitive data, particularly when a POP chain is present. Site administrators should be cautious, especially if they grant Subscribers the ability to use these features.

References