Vulnerability · Published Aug 3, 2026 · Assigned by WPScan

CVE-2025-15672Chama < 1.0.13 - Unauthenticated PHP Object Injection

High 8.1

In plain English

A high-severity unsafe deserialization in ChamaWP from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.6%top 48.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other installed code.

Affected products (as reported)

Vendor	Product	Versions
Unknown	ChamaWP	0 – before 1.0.13

Weakness: CWE-502 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://wpscan.com/vulnerability/8fcef037-db68-4595-be86-be3bf315c385/ exploit, vdb-entry, technical-description