CVE-2025-47552: 
WordPress vulnerability analysis and mitigation

CVE-2025-47552 is a PHP Object Injection vulnerability caused by Deserialization of Untrusted Data (CWE-502) in the DZS Video Gallery WordPress plugin by Digital Zoom Studio. It affects all versions up to and including 12.39 (initially reported as through 12.37, later revised). The vulnerability was reported by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on March 25, 2025, and published by Patchstack on May 20, 2025; the CVE was formally published on January 7, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical), assigned by Patchstack (Patchstack, Red Hat CVE).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data), enabling PHP Object Injection (CAPEC-586). The plugin fails to properly validate or sanitize user-supplied data before passing it to PHP deserialization functions, allowing an unauthenticated remote attacker to inject arbitrary PHP objects over the network. If a suitable Property-Oriented Programming (POP) chain exists within the application or its dependencies, this can be leveraged to achieve code execution, SQL injection, path traversal, or denial of service. No authentication or user interaction is required, and attack complexity is low (Patchstack).

Successful exploitation can result in complete compromise of the affected WordPress site, including unauthorized code execution, SQL injection, path traversal, and denial of service — contingent on the presence of a usable POP chain. All three security pillars are at high risk: confidentiality (sensitive data exposure), integrity (unauthorized data modification or deletion), and availability (service disruption). Because the attack requires no privileges and no user interaction, it is well-suited for mass-exploitation campaigns targeting large numbers of WordPress installations simultaneously (Patchstack).

As of the time of reporting, no public proof-of-concept exploit code has been identified and there is no confirmed evidence of active in-the-wild exploitation. The EPSS score is approximately 0.041% (0.000410), indicating a currently low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority and notes that vulnerabilities of this type are commonly used in mass-exploit campaigns against WordPress sites (Patchstack, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the DZS Video Gallery plugin (versions ≤ 12.39) using tools like WPScan, Shodan, or by inspecting plugin directories exposed via HTTP.
2. Identify deserialization endpoint: Locate the plugin's functionality that accepts and deserializes user-supplied data without proper validation (specific endpoint details are not publicly disclosed).
3. Craft malicious serialized payload: Construct a PHP serialized object payload targeting a known POP chain present in the WordPress environment or its installed plugins/themes.
4. Submit payload: Send the crafted payload to the vulnerable endpoint via an unauthenticated HTTP request (no credentials required).
5. Achieve objective: If a viable POP chain is present, the deserialized object triggers arbitrary code execution, SQL injection, file read/write, or other malicious actions on the server (Patchstack).

• Network: Unusual or malformed HTTP POST requests to DZS Video Gallery plugin endpoints containing serialized PHP data (e.g., strings beginning with O:, a:, or s: in request bodies or parameters); unexpected outbound connections from the web server.
• Logs: WordPress or web server access logs showing repeated unauthenticated requests to plugin-specific endpoints with large or encoded payloads; PHP error logs referencing deserialization or object instantiation errors.
• File System: Newly created or modified PHP files in the WordPress uploads directory or plugin directories; presence of web shells or backdoors not part of the original installation.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget, python) indicating potential code execution following exploitation.

The patched version of DZS Video Gallery is 12.40; all users running version 12.39 or earlier should update immediately via the WordPress plugin dashboard. Patchstack has issued a virtual patch (mitigation rule) for its subscribers to block exploitation attempts until the plugin is updated. As an interim measure, administrators unable to update immediately should consider disabling the plugin, restricting network access to WordPress admin interfaces, and monitoring for suspicious deserialization activity (Patchstack).

The vulnerability was covered by The Hacker Wire and mentioned in the CISA weekly vulnerability bulletin for the week of January 5, 2026, indicating it received standard industry attention for a critical WordPress plugin flaw. Patchstack, the assigning CNA, highlighted it as high priority due to the potential for mass-exploitation campaigns. No notable individual researcher commentary or significant social media debate beyond routine CVE tracking has been identified (CISA Bulletin, The Hacker Wire).