Description

The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import a malicious file and a suitable gadget chain is present on the blog.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.3",
  "pubDate": "2026-09-02T15:17:34.983Z",
  "pubdate": "2026-09-02T15:17:34.983Z",
  "executiveSummary": "The Weaver Show Posts WordPress plugin, specifically versions prior to 1.8.1, contains a critical security vulnerability involving the insecure deserialization of user-supplied input.\nThe vulnerability originates from the processing of imported files, which are passed to the PHP unserialize() function without adequate validation or sanitization.\nSuccessful exploitation of this flaw allows a high-privileged authenticated attacker to perform PHP Object Injection (POI).\nBy crafting a malicious serialized object, an attacker can leverage existing gadget chains present within the WordPress environment or the plugin itself to achieve arbitrary code execution, unauthorized file system access, or other malicious actions depending on the available PHP classes.\nBecause the vulnerability requires high-level administrative or equivalent privileges to initiate the file import process, the risk is scoped to scenarios where an attacker has already gained access to an administrative account or has compromised a privileged session.\nThis flaw presents a significant risk to the integrity and confidentiality of the WordPress installation, as it facilitates remote code execution (RCE) and potential complete system compromise if a viable gadget chain exists.",
  "technicalDetails": "The vulnerability resides in the file import mechanism of the Weaver Show Posts plugin, where the plugin attempts to restore configuration or content settings by unserializing data extracted from an uploaded file.\nThe root cause of this vulnerability is the use of the PHP unserialize() function on untrusted data sourced directly from a file upload without implementing appropriate integrity checks or input validation.\nIn PHP, the unserialize() function is inherently dangerous when processing user-controlled input because it allows the instantiation of arbitrary classes defined within the application's codebase or included libraries.\nAn attacker can construct a malicious serialized payload representing an object that triggers specific magic methods, such as __destruct(), __wakeup(), or __toString(), upon being unserialized.\nThe attack flow proceeds as follows: First, the attacker creates a serialized PHP object payload specifically crafted to interact with a 'gadget'—a piece of code already present in the application that performs sensitive operations like file deletion, system command execution, or data exfiltration.\nSecond, the attacker logs into the WordPress dashboard with high-level privileges and initiates the plugin's import feature, uploading the file containing the serialized payload.\nThird, the plugin code reads the file content and passes the malicious string into the vulnerable unserialize() function.\nFourth, PHP reconstructs the object, triggering the associated magic methods and the gadget chain.\nThe scope of the impact depends on the availability of 'pop chains' (Property Oriented Programming) within the environment. If the WordPress installation contains plugins or themes with classes that perform insecure actions within their destructor or wakeup methods, the attacker can hijack the control flow of the application.\nThe vulnerability affects all versions of Weaver Show Posts prior to 1.8.1. Because this is an authenticated remote vulnerability, it highlights the danger of high-privilege account compromise, as the attacker effectively uses the administrative functionality to execute arbitrary PHP logic.\nThis vulnerability is particularly dangerous as it bypasses standard security controls by operating at the logic layer of the application rather than the input validation layer typically targeted by traditional web attacks.\nFurthermore, the vulnerability is not limited by network exposure beyond the standard WordPress administrative interface, meaning the attack must be executed via the intended authenticated dashboard flow."
}