WordPress Plugin Vulnerabilities

Chama < 1.0.13 - Unauthenticated PHP Object Injection

Description

The plugin does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other installed code.

Proof of Concept

Affects Plugins

Plugin icon
chama
Fixed in 1.0.13

References

CVE
CVE-2025-15672

Classification

Type
OBJECT INJECTION
OWASP top 10
A8: Insecure Deserialization
CWE
CWE-502
CVSS
8.1 (high)

Miscellaneous

Original Researcher
Khaled Alenazi (Nxploited)
Submitter
Khaled Alenazi (Nxploited)
Submitter website
https://github.com/Nxploited
Verified
Yes
WPVDB ID
8fcef037-db68-4595-be86-be3bf315c385

Timeline

Publicly Published
2026-07-24 (about 10 days ago)
Added
2026-07-24 (about 9 days ago)
Last Updated
2026-07-31 (about 2 days ago)

Other

Published
Title
Published
2025-04-09
Title
Job Board Manager <= 2.1.60 - Authenticated (Contributor+) PHP Object Injection
Published
2025-04-21
Title
Altair <= 5.2.2 - Unauthenticated PHP Object Injection
Published
2026-02-18
Title
Grand Restaurant < 7.0.11 - Unauthenticated PHP Object Injection
Published
2024-04-29
Title
Grid Gallery < 1.4.4 - Contributor+ PHP Object Injection via shortcode
Published
2025-09-23
Title
Sign-up Sheets < 2.3.3 - Unauthenticated PHP Object Injection