Object Instantiation Vulnerability in Schema Plugin for WordPress

CVE-2025-7825

What is CVE-2025-7825?

The Schema Plugin For Divi, Gutenberg & Shortcodes is susceptible to a vulnerability that allows authenticated users with Contributor-level access or higher to exploit object instantiation through the deserialization of untrusted input in the wpt_schema_breadcrumbs shortcode. This could lead to potential PHP object injection attacks. Notably, the impact of this vulnerability depends on the presence of a payloads chain in other plugins or themes. If such a payloads chain exists, attackers could perform malicious actions, including deleting files, accessing sensitive information, or executing arbitrary code.

References