CVE-2025-30889: Testimonial Slider Object Injection Flaw

CVE-2025-30889 Overview

CVE-2025-30889 is a PHP Object Injection vulnerability in the PickPlugins Testimonial Slider plugin for WordPress. The flaw stems from deserialization of untrusted data [CWE-502] and affects all plugin versions up to and including 2.0.13. Authenticated attackers with low privileges can inject arbitrary PHP objects through unsafe unserialize() calls on attacker-controlled input. When a suitable property-oriented programming (POP) chain exists in the WordPress core, another plugin, or the active theme, exploitation can lead to remote code execution, arbitrary file operations, or full site compromise.

Critical Impact
Authenticated object injection in the Testimonial Slider plugin can chain with available POP gadgets to achieve remote code execution and full WordPress site takeover.

Affected Products

PickPlugins Testimonial Slider for WordPress
All versions from initial release through 2.0.13
WordPress sites with the plugin active and reachable POP gadget chains

Discovery Timeline

2025-04-03 - CVE-2025-30889 published to NVD with Patchstack advisory
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30889

Vulnerability Analysis

The Testimonial Slider plugin passes attacker-controlled data to PHP's unserialize() function without validating that the input represents a safe, expected type. PHP deserialization instantiates objects and triggers magic methods such as __wakeup(), __destruct(), and __toString() during reconstruction. An attacker who controls the serialized payload controls which classes are instantiated and which properties are populated, regardless of whether those classes are part of the plugin itself. Successful exploitation requires a low-privileged authenticated session, which lowers the bar substantially on multi-user WordPress installations that permit subscriber or contributor registration.

Root Cause

The root cause is unsafe deserialization of untrusted input, classified under [CWE-502]. The plugin relies on unserialize() for data that originates from a request parameter or stored field reachable by authenticated users. PHP's native deserializer does not enforce class allow-listing, so any class loaded in the WordPress runtime becomes an injection target. Modern WordPress installations bundle dozens of classes with exploitable magic methods, making gadget discovery practical for attackers familiar with the ecosystem.

Attack Vector

Exploitation is network-based and requires only low-level authentication. An attacker crafts a serialized PHP object payload referencing a known POP gadget chain present on the target site. The payload is submitted through a vulnerable plugin endpoint that stores or processes testimonial data. When the plugin calls unserialize() on the input, the gadget chain executes during object construction or destruction. Outcomes depend on the available gadgets and can include arbitrary file write, arbitrary file deletion, SQL execution, or full PHP code execution within the web server context.

No public proof-of-concept code has been verified at this time. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-30889

Indicators of Compromise

HTTP POST requests to Testimonial Slider plugin endpoints containing serialized PHP markers such as O:, a:, or s: followed by length specifiers
Unexpected PHP files written into wp-content/uploads/ or other writable directories shortly after plugin requests
New or modified WordPress administrator accounts created by low-privileged users
Web server processes spawning shell utilities such as sh, bash, or curl with outbound connections

Detection Strategies

Inspect web application logs for request bodies containing PHP serialization syntax sent to /wp-admin/admin-ajax.php or plugin-specific routes
Enable WordPress audit logging to capture testimonial creation, update, and meta-write events by non-administrative users
Hunt for file integrity changes in plugin and theme directories that correlate with authenticated user sessions

Monitoring Recommendations

Forward WordPress, PHP-FPM, and web server logs to a centralized analytics platform for correlation across request, file, and process events
Alert on anomalous child processes spawned by php-fpm or apache2 users
Track outbound network connections from web server hosts to unfamiliar destinations following plugin requests

How to Mitigate CVE-2025-30889

Immediate Actions Required

Inventory all WordPress sites and identify those running PickPlugins Testimonial Slider version 2.0.13 or earlier
Deactivate and remove the plugin on affected sites until a patched release is verified
Audit user accounts with contributor, author, or subscriber roles and remove unused or untrusted accounts
Review recent testimonial submissions and plugin-related database entries for serialized payloads

Patch Information

At the time of NVD publication, the advisory lists affected versions through 2.0.13 with no fixed version specified. Monitor the Patchstack Vulnerability Report and the official plugin page for an updated release that addresses CVE-2025-30889.

Workarounds

Disable the Testimonial Slider plugin until a vendor patch is available and verified
Deploy a web application firewall rule that blocks request bodies containing PHP serialization patterns such as O:[0-9]+: targeting plugin endpoints
Restrict user registration and reduce the number of accounts with content submission privileges
Apply least-privilege file system permissions so the web server user cannot write to PHP-executable directories

bash

# Example WAF rule (ModSecurity) to block serialized PHP objects in request bodies
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1003089,\
    msg:'Possible PHP object injection - CVE-2025-30889'"
    SecRule REQUEST_BODY "@rx O:[0-9]+:\"[A-Za-z_\\\\]+\":[0-9]+:" "t:none"