Description

The Turnkey bbPress by WeaverTheme plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.1 via deserialization of untrusted input in the wvrbbp_set_to_serialized_values() function (reached through the wvrbbp_save_restore() settings-restore handler). The function reads the raw contents of an administrator-uploaded file and passes them directly to unserialize() without any validation. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable plugin itself; however, if a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.6",
  "pubDate": "2026-08-16T06:16:49.210Z",
  "pubdate": "2026-08-16T06:16:49.210Z",
  "executiveSummary": "The Turnkey bbPress by WeaverTheme plugin for WordPress is susceptible to a PHP Object Injection vulnerability affecting all versions up to, and including, 1.7.1. The flaw stems from insecure deserialization of untrusted input within the settings-restore functionality.\nThe primary impact of this vulnerability is the potential for arbitrary file deletion, sensitive data retrieval, or remote code execution, contingent upon the presence of a compatible Property Oriented Programming (POP) chain within the broader application environment, such as an installed theme or another vulnerable plugin.\nThe affected product is the Turnkey bbPress by WeaverTheme plugin. Risk implications are severe if exploitation is chained with external gadget classes, potentially leading to full system compromise.\nAttacker capabilities are restricted by authentication and privilege requirements; the attacker must possess administrator-level access or higher to interact with the vulnerable settings-restore handler and upload the malicious payload file.\nExploitation requires administrative privileges, access to the WordPress backend administration panel, and the existence of a viable POP chain within the target installation.",
  "technicalDetails": "The vulnerability resides in the Turnkey bbPress by WeaverTheme plugin within the wvrbbp_set_to_serialized_values() function, which is reached through the wvrbbp_save_restore() settings-restore handler.\nThe root cause of the vulnerability is the direct passage of raw, untrusted input from an administrator-uploaded file directly to the PHP unserialize() function without prior type checking, sanitization, or cryptographic validation.\nThe vulnerable component is the file upload and settings restoration mechanism implemented by the plugin. Affected versions include all iterations up to, and including, version 1.7.1.\nAuthentication and privilege requirements mandate that the executing user must possess administrator-level privileges or higher within the WordPress installation. Network exposure is constrained to the administrative interface accessible over HTTP or HTTPS.\nThe attack flow proceeds in a sequential manner. First, an authenticated attacker with administrator privileges navigates to the administrative interface corresponding to the Turnkey bbPress by WeaverTheme plugin settings-restore feature.\nSecond, the attacker crafts a malicious file containing a serialized PHP object payload designed to leverage available gadget classes. The attacker then uploads this file via the wvrbbp_save_restore() handler.\nThird, the wvrbbp_set_to_serialized_values() function reads the raw contents of the uploaded file and passes the raw data directly to the native PHP unserialize() function.\nFourth, during the object instantiation phase, PHP invokes magic methods such as __wakeup() or __destruct() on the deserialized data. While the Turnkey bbPress by WeaverTheme plugin itself does not contain a native POP chain, the execution environment evaluates the payload against all loaded classes.\nIf a valid POP chain exists via an additional installed plugin or theme on the target system, the payload executes successfully, resulting in post-exploitation impacts such as arbitrary file deletion, retrieval of sensitive system data, or execution of arbitrary code within the context of the web server process."
}