CVE-2025-31074: Mobile DJ Manager Object Injection Flaw

CVE-2025-31074 Overview

CVE-2025-31074 is a PHP Object Injection vulnerability in the MDJM Mobile DJ Manager WordPress plugin (mobile-dj-manager). The flaw results from deserialization of untrusted data [CWE-502] and affects all versions through 1.7.5.2. Authenticated attackers with low privileges can submit crafted serialized payloads that the plugin unserializes, triggering arbitrary PHP object instantiation. When combined with reachable PHP magic methods, this leads to remote code execution, file manipulation, or database compromise on the WordPress host.

Critical Impact
Authenticated attackers can achieve remote code execution on WordPress sites running MDJM Mobile DJ Manager <= 1.7.5.2, resulting in full site takeover.

Affected Products

MDJM Mobile DJ Manager plugin for WordPress, versions n/a through 1.7.5.2
WordPress installations with the mobile-dj-manager plugin enabled
Sites running PHP environments containing gadget chains reachable via the plugin

Discovery Timeline

2025-04-01 - CVE-2025-31074 published to the National Vulnerability Database
2026-04-23 - CVE record last updated in NVD

Technical Details for CVE-2025-31074

Vulnerability Analysis

The vulnerability stems from passing attacker-controlled input to a PHP deserialization function such as unserialize() without validation. PHP Object Injection allows an attacker to instantiate arbitrary classes available in the application scope. When a deserialized object is later destroyed or accessed, PHP magic methods such as __wakeup(), __destruct(), or __toString() execute. Attackers chain these methods through gadget chains present in WordPress core, the plugin, or other installed plugins.

The attack requires low-privilege authentication, which on many WordPress sites includes subscriber or customer roles. The result is remote code execution, file read or write, or arbitrary SQL execution under the WordPress database user.

Root Cause

The root cause is unsafe deserialization of user-supplied data in the MDJM Mobile DJ Manager plugin. The plugin invokes PHP deserialization on input that originates from request parameters, postmeta, or option values controllable by authenticated users. No allow-list of permitted classes or integrity validation precedes the call.

Attack Vector

The attack vector is network-based over HTTP(S) against the WordPress admin or AJAX endpoints exposed by the plugin. Exploitation requires an authenticated session. The attacker submits a serialized PHP payload referencing a gadget chain class. When the plugin deserializes the payload, the chain executes server-side. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-31074

Indicators of Compromise

Unexpected PHP files written to wp-content/uploads/ or plugin directories following requests to MDJM endpoints
WordPress request logs containing serialized PHP markers such as O: or a: in parameters posted to mobile-dj-manager handlers
New or modified administrator accounts created shortly after authenticated requests to MDJM AJAX actions
Outbound network connections from the web server process to attacker-controlled hosts

Detection Strategies

Inspect HTTP request bodies and query strings for PHP serialized object signatures (O:[0-9]+:") targeting MDJM endpoints
Audit WordPress access logs for low-privilege users invoking MDJM admin-ajax actions outside normal workflows
Monitor PHP error logs for __wakeup, __destruct, or class instantiation errors originating from plugin code paths

Monitoring Recommendations

Enable file integrity monitoring on the WordPress installation, including the mobile-dj-manager plugin directory
Forward web server, PHP-FPM, and WordPress audit logs to a centralized SIEM for correlation
Alert on web server processes spawning shells, curl, wget, or compilers, which indicate post-exploitation

How to Mitigate CVE-2025-31074

Immediate Actions Required

Update the MDJM Mobile DJ Manager plugin to a release later than 1.7.5.2 as soon as the vendor publishes a fixed version
Restrict registration and limit low-privilege account creation on affected WordPress sites until patched
Review existing user accounts and revoke unrecognized administrator or editor roles
Rotate WordPress secret keys in wp-config.php and reset administrator passwords if exploitation is suspected

Patch Information

No fixed version is identified in the published CVE record beyond confirmation that releases up to and including 1.7.5.2 are vulnerable. Monitor the Patchstack advisory and the plugin's WordPress.org page for an updated release. Apply the patch immediately upon availability.

Workarounds

Deactivate and remove the mobile-dj-manager plugin until a patched version is installed
Deploy a web application firewall rule blocking requests containing PHP serialized object patterns to MDJM endpoints
Restrict access to wp-admin and admin-ajax.php MDJM actions by IP allow-list where operationally feasible

bash

# Example WAF rule fragment blocking serialized PHP objects to MDJM endpoints
SecRule REQUEST_URI "@contains mobile-dj-manager" \
  "chain,phase:2,deny,status:403,id:1003107,msg:'Possible PHP Object Injection - CVE-2025-31074'"
SecRule ARGS|REQUEST_BODY "@rx O:\d+:\"[A-Za-z_\\x7f-\\xff][A-Za-z0-9_\\x7f-\\xff]*\":\d+:" "t:none"