CVE-2025-47553: 
WordPress vulnerability analysis and mitigation

CVE-2025-47553 is a PHP Object Injection vulnerability caused by Deserialization of Untrusted Data (CWE-502) in the Digital Zoom Studio (DZS) Video Gallery WordPress plugin. It affects all versions through 12.39 (initially reported as through 12.25, later revised). The vulnerability was reported by researcher Phat RiO on April 13, 2025, and published by Patchstack on May 21, 2025; the CVE was formally published on January 6, 2026. It carries a CVSS v3.1 base score of 8.8 (High), assigned by Patchstack (Patchstack, NVD).

The vulnerability stems from insecure deserialization of user-supplied data within the DZS Video Gallery WordPress plugin (CWE-502), enabling PHP Object Injection (CAPEC-586). An authenticated attacker with low privileges (e.g., Subscriber role) can supply a crafted serialized PHP object to the plugin, which is deserialized without proper validation. If a suitable Property-Oriented Programming (POP) chain exists within the WordPress installation or its plugins/themes, this can be leveraged to achieve code execution, SQL injection, path traversal, or denial of service. No specific technical write-up or public PoC code has been identified at this time (Patchstack).

Successful exploitation can result in complete compromise of the affected WordPress site, with high impact to confidentiality (unauthorized access to sensitive data), integrity (modification or deletion of data), and availability (disruption of service). The attack requires only low-privilege authentication and no user interaction, making it accessible to any registered user on the site. Depending on available POP chains in the environment, attackers could achieve remote code execution, enabling lateral movement within the hosting environment or further compromise of the underlying server (Patchstack).

As of the time of reporting, no public proof-of-concept exploit code has been identified and there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.048%, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority, noting that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites running the DZS Video Gallery plugin (versions ≤ 12.39) using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Obtain low-privilege access: Register or obtain credentials for a low-privilege account (e.g., Subscriber) on the target WordPress site.
3. Identify injection point: Locate the plugin functionality that accepts and deserializes user-supplied data — typically via a form field, API parameter, or cookie processed by the plugin.
4. Craft malicious serialized object: Using a PHP serialization tool or framework (e.g., PHPGGC), generate a serialized PHP object payload targeting a known POP chain present in the WordPress environment.
5. Submit payload: Authenticate to the site and submit the crafted serialized payload to the vulnerable plugin endpoint.
6. Trigger deserialization: The plugin deserializes the attacker-controlled object, invoking magic methods (__wakeup, __destruct) in the POP chain.
7. Achieve objective: Depending on the POP chain, execute arbitrary code, perform SQL injection, write a web shell, or exfiltrate data from the server (Patchstack).

• Network: Unusual authenticated POST requests to DZS Video Gallery plugin endpoints containing serialized PHP data (e.g., strings beginning with O: or a: in request bodies or parameters).
• Logs: WordPress or web server access logs showing repeated authenticated requests to plugin-specific endpoints from low-privilege accounts; PHP error logs referencing unexpected class instantiation or magic method invocations.
• File System: Newly created or modified PHP files in the WordPress uploads directory or plugin directories; presence of web shells (e.g., files with eval, base64_decode, system, or exec patterns).
• Process: Unexpected child processes spawned by the web server process (e.g., bash, curl, wget) indicating potential code execution via a POP chain.

The vulnerability is patched in DZS Video Gallery version 12.40; all site administrators should update to this version or later immediately (Patchstack). If immediate updating is not possible, restrict access to the WordPress site to authorized users only and consider temporarily deactivating the plugin. Patchstack users benefit from a virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated. Additionally, implement strong authentication controls and monitor for suspicious deserialization activity in application logs.

The vulnerability was covered in CISA's weekly vulnerability bulletin for the week of January 5, 2026, and noted by security aggregators including VulDB, Vulners, and The Hacker Wire. Patchstack, the assigning CNA, classified it as high priority and issued a virtual patch for its users. No notable independent researcher commentary or significant media coverage beyond standard vulnerability reporting has been identified.