Skip to content
Sign in
8.1 High

CVE-2025-15672 The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP…

Description

The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other installed code.

Affected products and versions

Product Affected versions Fixed in
ChamaWP 1.0 earliest → < 1.0.13 1.0.13

Other CVEs of ChamaWP

The 2 CVEs of ChamaWP →
CVE-2026-16300 The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing… 9.8 Critical
Track this CVE