CVE-2025-27287: SS Quiz Deserialization Vulnerability

CVE-2025-27287 Overview

CVE-2025-27287 is a PHP Object Injection vulnerability in the SS Quiz WordPress plugin (ssquiz) developed by ssvadim. The flaw stems from deserialization of untrusted data [CWE-502] and affects all versions up to and including 2.0.5. An unauthenticated attacker can inject crafted serialized PHP objects over the network. When the plugin processes the malicious payload, attacker-controlled objects are instantiated within the WordPress runtime. Depending on available PHP gadget chains in the WordPress core or other installed plugins, exploitation can lead to remote code execution, arbitrary file operations, or data tampering on the host site.

Critical Impact
Unauthenticated attackers can trigger PHP object injection against WordPress sites running SS Quiz <= 2.0.5, with potential for full site compromise when reachable gadget chains exist.

Affected Products

ssvadim SS Quiz (ssquiz) WordPress plugin — all versions through 2.0.5
WordPress installations with the SS Quiz plugin active
Hosting environments serving the vulnerable plugin to unauthenticated visitors

Discovery Timeline

2025-04-17 - CVE-2025-27287 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-27287

Vulnerability Analysis

The vulnerability is classified as Insecure Deserialization / Object Injection under [CWE-502]. SS Quiz passes attacker-influenced input into a PHP deserialization routine without validating the data type, source, or structure. PHP's unserialize() function reconstructs arbitrary object graphs from serialized strings and invokes magic methods such as __wakeup(), __destruct(), and __toString() during object lifecycle events. When these magic methods exist in any class loaded by WordPress, an attacker can chain them into a gadget that performs file writes, SQL execution, or command execution.

The attack requires no authentication, no user interaction, and is exploitable over the network against a default-configured WordPress site that has the plugin installed and activated.

Root Cause

The root cause is the plugin passing untrusted input directly to PHP's deserialization mechanism. SS Quiz does not enforce an allowlist of permitted classes through the allowed_classes option of unserialize(), nor does it cryptographically sign or HMAC-validate serialized blobs before processing. This allows arbitrary object instantiation from a request body or parameter under attacker control.

Attack Vector

Exploitation occurs over HTTP or HTTPS against the WordPress front-end or admin-ajax endpoints exposed by the plugin. The attacker submits a serialized PHP payload containing one or more gadget objects. Once the plugin deserializes the payload, the gadget chain executes during object construction or destruction. Refer to the Patchstack WordPress Vulnerability advisory for technical details on the vulnerable code path.

Detection Methods for CVE-2025-27287

Indicators of Compromise

HTTP request bodies or query parameters containing serialized PHP patterns such as O: (object), a: (array), or s: (string) targeting SS Quiz endpoints
Unexpected PHP files written under wp-content/uploads/ or plugin directories following requests to ssquiz URLs
WordPress administrator or option table changes that do not correlate with legitimate admin sessions
Outbound network connections from the PHP worker process to attacker-controlled infrastructure

Detection Strategies

Inspect web access logs for POST or GET requests to SS Quiz handlers containing serialized object markers like O:8: or __PHP_Incomplete_Class
Deploy a Web Application Firewall (WAF) rule that blocks serialized PHP payloads in request parameters bound to plugin endpoints
Monitor PHP error logs for __wakeup, __destruct, or class-not-found warnings triggered during deserialization
Run integrity monitoring on the WordPress installation to detect unauthorized file changes

Monitoring Recommendations

Forward WordPress, web server, and PHP-FPM logs to a centralized log analytics platform for correlation
Alert on PHP processes spawning shell utilities such as bash, sh, curl, wget, or python on web servers
Track creation of new administrator accounts and changes to the wp_options table

How to Mitigate CVE-2025-27287

Immediate Actions Required

Deactivate and remove the SS Quiz plugin from any WordPress site where an upgraded version is not yet available
Apply WAF virtual patching to block serialized PHP payloads targeting ssquiz request paths
Audit affected sites for indicators of post-exploitation activity including rogue admin users, modified plugin files, and unknown scheduled tasks (wp_cron)
Rotate all WordPress credentials, secret keys in wp-config.php, and API tokens issued by the affected site

Patch Information

At the time of NVD publication, no fixed version beyond 2.0.5 has been confirmed for SS Quiz. Monitor the Patchstack advisory for vendor updates and install any subsequently released version as soon as it is published.

Workarounds

Uninstall the SS Quiz plugin until a patched release is available
Restrict access to plugin endpoints at the web server or reverse proxy layer using IP allowlists
Configure a WAF signature to reject request bodies containing serialized PHP object markers such as O: followed by a digit and class name
Run WordPress under a least-privilege filesystem account that cannot write to PHP source directories

bash

# Example NGINX configuration to block requests to the vulnerable plugin
location ~* /wp-content/plugins/ssquiz/ {
    deny all;
    return 403;
}

# Example ModSecurity rule to flag serialized PHP object payloads
SecRule ARGS "@rx O:\d+:\"[a-zA-Z_\\\\]+\":\d+:" \
    "id:1002787,phase:2,deny,status:403,msg:'PHP Object Injection attempt (CVE-2025-27287)'"