CVE-2025-67535: 
WordPress vulnerability analysis and mitigation

CVE-2025-67535 is a PHP Object Injection vulnerability (Deserialization of Untrusted Data) in the WP Maps WordPress plugin (formerly known as WP Google Map Plugin) by Flipper Code / WePlugins. It affects all versions up to and including 4.8.6, with version 4.8.7 being the patched release. The vulnerability was reported on October 3, 2025, and published by Patchstack on November 2, 2025. It carries a CVSS v3.1 base score of 6.5–6.6 (Medium) (Patchstack).

The root cause is improper deserialization of untrusted data (CWE-502), which enables PHP Object Injection (CAPEC-586). When user-supplied or attacker-controlled serialized data is passed to PHP's unserialize() function without adequate validation, an attacker can instantiate arbitrary PHP objects. If a suitable Property-Oriented Programming (POP) chain exists within the WordPress installation or its plugins/themes, this can be leveraged to achieve code execution, SQL injection, path traversal, or denial of service. Exploitation requires Administrator or Developer-level privileges and local access context, limiting the attack surface (Patchstack).

Successful exploitation could allow a privileged attacker to inject malicious PHP objects, potentially leading to remote code execution, SQL injection, arbitrary file read/write via path traversal, or denial of service — contingent on the presence of a usable POP chain in the target environment. The confidentiality, integrity, and availability of the affected WordPress site are all at high risk if exploitation succeeds. The practical impact is constrained by the requirement for high privileges and user interaction, making mass exploitation less likely without additional vulnerabilities (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-67535. The EPSS score is extremely low at approximately 0.018%, reflecting a low probability of near-term exploitation. Patchstack classifies this as low priority with no impactful threat currently observed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires Administrator or Developer privileges and user interaction, further reducing the likelihood of opportunistic attacks (Patchstack).

The vendor has released version 4.8.7 of the WP Maps plugin, which patches this vulnerability. Site administrators should update the plugin to version 4.8.7 or later immediately via the WordPress admin dashboard or by downloading the latest version from the WordPress plugin repository. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, restricting Administrator and Developer account access and monitoring for unusual plugin behavior are recommended interim measures (Patchstack).

Patchstack, which assigned and disclosed this CVE, classifies the vulnerability as low priority with no impactful threat currently observed, noting it is unlikely to be exploited in its current state. No notable researcher commentary, vendor statements beyond the patch release, or significant media coverage has been identified for this vulnerability (Patchstack).