CVE-2025-30892: WpTravelly Object Injection Vulnerability

CVE-2025-30892 Overview

CVE-2025-30892 is a PHP Object Injection vulnerability in the magepeopleteam WpTravelly (tour-booking-manager) WordPress plugin. The flaw stems from insecure deserialization of untrusted data [CWE-502] and affects all plugin versions up to and including 1.8.7. An authenticated attacker with low privileges can submit crafted serialized payloads that the plugin passes to PHP's unserialize() routine, triggering object instantiation under attacker control. Successful exploitation can lead to remote code execution, data tampering, and full compromise of the WordPress site when a suitable gadget chain is present.

Critical Impact
Authenticated attackers can inject malicious PHP objects to achieve code execution, write or read arbitrary data, and pivot to full site takeover on vulnerable WpTravelly installations.

Affected Products

magepeopleteam WpTravelly (tour-booking-manager) plugin for WordPress
All versions from n/a through 1.8.7
WordPress sites with the vulnerable plugin activated

Discovery Timeline

2025-04-01 - CVE-2025-30892 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30892

Vulnerability Analysis

The vulnerability is an Object Injection issue caused by deserialization of untrusted data. The WpTravelly plugin accepts attacker-influenced input and passes it to PHP's unserialize() function without validating the structure or origin of the serialized blob. When PHP deserializes the payload, it reconstructs arbitrary objects and invokes magic methods such as __wakeup() and __destruct() during object lifecycle handling.

If any class loaded in the WordPress runtime contains exploitable logic in these magic methods, an attacker can chain those classes into a gadget chain. The result ranges from arbitrary file writes and SQL execution to remote command execution, depending on the gadgets available in WordPress core, the active theme, and other installed plugins.

The network-reachable attack surface combined with low privilege requirements and no user interaction makes this a high-impact issue for any site running WpTravelly version 1.8.7 or earlier.

Root Cause

The root cause is improper handling of serialized input by the tour-booking-manager plugin. User-controllable data is deserialized without an allowlist of expected classes and without integrity verification, which is the classic precondition for PHP Object Injection.

Attack Vector

An authenticated attacker with low-privileged access sends an HTTP request containing a crafted serialized string to a vulnerable plugin endpoint. The plugin unserializes the payload, instantiating attacker-chosen classes and triggering magic methods that execute the gadget chain. No user interaction is required beyond the attacker's own request.

No verified public proof-of-concept code is available. Refer to the Patchstack WordPress Plugin Advisory for additional technical context.

Detection Methods for CVE-2025-30892

Indicators of Compromise

HTTP POST or GET requests to WpTravelly endpoints containing serialized PHP markers such as O:, a:, or s: followed by integers and class names.
Unexpected PHP files written under wp-content/uploads/ or theme and plugin directories shortly after requests to tour booking endpoints.
New or modified WordPress administrator accounts created without a corresponding admin session.
Outbound network connections from the web server process (php-fpm, apache2) to unfamiliar IP addresses or domains.

Detection Strategies

Inspect web server access logs for serialized PHP payloads in request bodies and query parameters targeting tour-booking-manager routes.
Hunt for unusual unserialize() activity by enabling PHP error and audit logging on WordPress hosts.
Correlate authenticated low-privilege user sessions with file system changes in WordPress directories.

Monitoring Recommendations

Forward WordPress, web server, and PHP logs to a centralized analytics platform and alert on serialized object patterns in plugin request parameters.
Monitor file integrity for wp-content/plugins/tour-booking-manager/ and the broader WordPress installation.
Track creation of new administrative users and changes to user roles in the wp_users and wp_usermeta tables.

How to Mitigate CVE-2025-30892

Immediate Actions Required

Update the WpTravelly (tour-booking-manager) plugin to a version later than 1.8.7 as soon as the vendor publishes a patched release.
Audit existing low-privilege WordPress accounts and revoke any that are unused or unrecognized.
Review web server and WordPress logs for evidence of exploitation against tour booking endpoints since the plugin was installed.
Rotate WordPress secret keys in wp-config.php and reset administrator credentials if compromise is suspected.

Patch Information

Consult the Patchstack WordPress Plugin Advisory for the current fix status and upgrade guidance from magepeopleteam. Apply the vendor-supplied update on all affected WordPress sites once available.

Workarounds

Deactivate and remove the WpTravelly plugin until a fixed version is installed.
Restrict access to WordPress authenticated endpoints using a web application firewall rule that blocks serialized PHP payloads in request parameters.
Enforce least privilege for WordPress user roles so untrusted users cannot reach plugin endpoints that perform deserialization.

bash

# Example WAF rule pattern to block serialized PHP objects in request bodies
SecRule ARGS "@rx (?:^|[&=])(?:O|a|s):[0-9]+:\"" \
    "id:1009030892,phase:2,deny,status:403,log,msg:'Possible PHP Object Injection (CVE-2025-30892)'"