CVE-2025-22510 Overview
CVE-2025-22510 is a PHP Object Injection vulnerability in the WC Price History for Omnibus WordPress plugin maintained by kkarpieszuk. The flaw stems from deserialization of untrusted data [CWE-502] and affects all plugin versions up to and including 2.1.4. An authenticated attacker with high privileges can inject crafted serialized PHP objects, triggering magic methods that lead to code execution, file manipulation, or data tampering when a suitable gadget chain is present. The vulnerability impacts confidentiality, integrity, and availability of the affected WooCommerce store.
Critical Impact
Successful exploitation enables object injection on the WordPress host, which can escalate to remote code execution, sensitive data disclosure, or destructive actions against the WooCommerce environment.
Affected Products
- kkarpieszuk WC Price History for Omnibus plugin versions up to and including 2.1.4
- WordPress sites running WooCommerce with the wc-price-history plugin enabled
- Installations that have not upgraded beyond version 2.1.4
Discovery Timeline
- 2025-01-09 - CVE-2025-22510 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-22510
Vulnerability Analysis
The plugin processes serialized PHP input without verifying its origin or integrity. PHP's unserialize() function reconstructs objects from string input and invokes magic methods such as __wakeup(), __destruct(), and __toString() during the process. When attacker-controlled data reaches this function, an adversary can instantiate arbitrary classes present in the WordPress runtime, including WooCommerce and other loaded plugins.
The attack succeeds because no allow-list or signature mechanism gates which classes can be deserialized. Combined with available POP (Property-Oriented Programming) gadgets in the WordPress ecosystem, object injection often results in file writes, SQL injection, or arbitrary code execution. The vulnerability requires authenticated access with high privileges, but does not require user interaction.
Root Cause
The root cause is unsafe use of unserialize() against input that is influenced by an authenticated user. The plugin trusts serialized data passed through plugin-specific request handlers and stores or processes it without validation. Refer to the Patchstack Vulnerability Report for the specific code path.
Attack Vector
The attack is performed over the network against the WordPress admin or plugin endpoints. The attacker, authenticated with high privileges, submits a crafted serialized payload that the plugin deserializes. Triggered magic methods then execute the gadget chain. No physical or local access is required, and no victim interaction is needed once the request is delivered.
Detection Methods for CVE-2025-22510
Indicators of Compromise
- HTTP requests to wc-price-history plugin endpoints containing serialized PHP markers such as O:, a:, or s: patterns in parameters
- Unexpected PHP errors referencing unserialize(), __wakeup, or __destruct in WordPress or PHP-FPM logs
- Creation of new admin users, modified WordPress options, or unexpected files in wp-content/uploads shortly after plugin interaction
- Outbound network connections initiated by the WordPress PHP process to unfamiliar hosts
Detection Strategies
- Inspect web access logs for POST or GET requests to wc-price-history routes containing serialized object signatures
- Enable WordPress audit logging to record privileged user actions on plugin settings and capture payload contents
- Compare installed plugin version against 2.1.4 to identify vulnerable installations across the estate
Monitoring Recommendations
- Forward WordPress, PHP-FPM, and web server logs to a centralized analytics platform for correlation and retention
- Alert on file integrity changes within wp-content/plugins/wc-price-history and broader wp-content directories
- Monitor for new WordPress administrator accounts, role changes, and modifications to wp_options entries
How to Mitigate CVE-2025-22510
Immediate Actions Required
- Identify all WordPress instances running WC Price History for Omnibus and confirm the installed version
- Update the plugin to a version released after 2.1.4 that addresses the deserialization flaw
- Audit administrator and shop manager accounts, rotating credentials and removing unused privileged users
- Review recent plugin-related requests in web logs for signs of exploitation attempts
Patch Information
Upgrade wc-price-history to a fixed release later than 2.1.4 as indicated in the Patchstack Vulnerability Report. Verify the upgrade in a staging environment before applying to production WooCommerce sites.
Workarounds
- Disable and remove the wc-price-history plugin until a fixed version can be deployed
- Restrict administrative WordPress access to trusted networks via IP allow-listing or VPN
- Deploy a web application firewall rule that blocks request parameters containing PHP serialized object patterns targeting plugin endpoints
- Enforce least privilege so that only essential users hold high-privilege WordPress roles
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
