CVE-2025-14476: 
WordPress vulnerability analysis and mitigation

CVE-2025-14476 is a PHP Object Injection vulnerability in the Doubly – Cross Domain Copy Paste for WordPress plugin, affecting all versions up to and including 1.0.46. The flaw arises from deserialization of untrusted input from the content.txt file within uploaded ZIP archives, enabling authenticated attackers with Subscriber-level access (when explicitly permitted by an administrator) to inject PHP objects. It was published on December 13, 2025, and carries a CVSS v3.1 base score of 8.8 (High) (Red Hat CVE, Wordfence).

The root cause is CWE-502: Deserialization of Untrusted Data — the plugin's import functionality deserializes the contents of content.txt extracted from user-supplied ZIP archives without adequate validation (Wordfence). The vulnerable code paths are located in inc_php/functions.class.php (line 1040) and inc_php/importer.class.php (line 2536) of version 1.0.46 (ENISA EUVD). Exploitation requires the attacker to craft a malicious ZIP archive containing a serialized PHP object payload in content.txt and upload it via the plugin's import feature; if a suitable POP (Property-Oriented Programming) chain exists in the WordPress environment, arbitrary code execution or other destructive actions become possible. The attack vector is network-based, requires low privileges (Subscriber role), and no user interaction, but is gated by an administrator explicitly enabling Subscriber-level upload access.

Successful exploitation can result in full compromise of the affected WordPress site, including arbitrary code execution, deletion of files, and retrieval of sensitive data such as credentials or personal information — all with high confidentiality, integrity, and availability impact (Red Hat CVE, Wordfence). The actual impact depends on the presence and nature of available POP chain gadgets within the WordPress installation and its plugins/themes. In worst-case scenarios, an attacker could achieve remote code execution, potentially enabling lateral movement to other systems or services accessible from the web server.

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.076%, indicating a currently low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement that an administrator must have explicitly enabled Subscriber-level access to the ZIP upload functionality, limiting the attack surface.

1. Reconnaissance: Identify WordPress sites running the Doubly – Cross Domain Copy Paste plugin version ≤ 1.0.46 using tools like WPScan or Shodan, and confirm that Subscriber-level ZIP upload access has been enabled by the administrator.
2. Account acquisition: Register or obtain a Subscriber-level (or higher) account on the target WordPress site.
3. Craft malicious ZIP archive: Create a ZIP file containing a content.txt file with a serialized PHP object payload targeting a known POP chain available in the WordPress environment (e.g., from installed plugins or themes).
4. Upload the archive: Use the plugin's import/upload feature to submit the crafted ZIP archive to the target site while authenticated as a Subscriber.
5. Trigger deserialization: The plugin extracts and deserializes the contents of content.txt via the vulnerable code in importer.class.php, instantiating the injected PHP object.
6. Achieve objective: If a suitable POP chain is present, the deserialized object triggers arbitrary code execution, file deletion, data exfiltration, or other actions depending on available gadgets (Wordfence, ENISA EUVD).

• Network: Unusual HTTP POST requests to WordPress endpoints associated with the Doubly plugin's import/upload functionality from low-privileged user accounts.
• File System: Unexpected ZIP file uploads in the WordPress uploads directory; presence of unfamiliar PHP files or web shells in the WordPress installation tree following an import operation.
• Logs: WordPress access logs showing Subscriber-level accounts performing ZIP archive uploads via the Doubly plugin import feature; PHP error logs referencing deserialization errors or unexpected class instantiation in importer.class.php or functions.class.php.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) following a plugin import event.

The primary remediation is to update the Doubly – Cross Domain Copy Paste for WordPress plugin to a version newer than 1.0.46 (Wordfence). As an immediate workaround, administrators should disable Subscriber-level access to the ZIP archive upload/import feature if it is not operationally required. Additional hardening measures include restricting file upload permissions, implementing strict input validation for uploaded files, and auditing plugin configurations regularly (Red Hat CVE).

Wordfence, the discovering and assigning organization, published the vulnerability in their weekly WordPress vulnerability report for December 8–14, 2025, and it was picked up by security aggregators including RedPacket Security and CISA's vulnerability bulletin (Wordfence Blog, CISA Bulletin). Social media coverage was limited to automated security alert accounts on Mastodon and Bluesky. No notable independent researcher commentary or significant media coverage beyond standard vulnerability aggregation was observed.