CVE-2025-32647: PickPlugins Question Answer Vulnerability

CVE-2025-32647 Overview

CVE-2025-32647 is a PHP Object Injection vulnerability in the PickPlugins Question Answer plugin for WordPress. The flaw stems from deserialization of untrusted data [CWE-502] and affects all versions of the question-answer plugin up to and including 1.2.73. An authenticated attacker with low privileges can submit crafted serialized payloads that the plugin unserializes, enabling object injection against the WordPress site. Successful exploitation can lead to remote code execution, data tampering, or full compromise of the underlying site when a suitable POP (Property-Oriented Programming) chain is available in the WordPress core or other installed plugins.

Critical Impact
Authenticated attackers can trigger PHP object injection over the network, with high impact to confidentiality, integrity, and availability of affected WordPress installations.

Affected Products

PickPlugins Question Answer plugin for WordPress
All versions from n/a through <= 1.2.73
WordPress sites with the question-answer plugin activated

Discovery Timeline

2025-04-17 - CVE-2025-32647 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32647

Vulnerability Analysis

The vulnerability is an insecure deserialization issue classified under [CWE-502]. The Question Answer plugin passes attacker-controlled input to PHP's unserialize() function without validating or restricting the resulting object types. When PHP reconstructs an object from a serialized string, magic methods such as __wakeup(), __destruct(), and __toString() may execute on the resulting instance. Attackers chain these methods through classes already loaded by WordPress or other plugins to achieve arbitrary code execution, arbitrary file writes, or SQL injection.

The EPSS score is 0.383% with a percentile of 30.011, indicating modest near-term exploitation likelihood. However, WordPress plugin object injection flaws are routinely weaponized once public POP gadgets are documented. The Patchstack advisory tracks this as a PHP Object Injection vulnerability with high impact across confidentiality, integrity, and availability.

Root Cause

The root cause is the plugin invoking unserialize() on data sourced from a request parameter, cookie, or stored database value that is influenced by authenticated users. PHP deserialization is unsafe by design when the input is attacker-controlled because class instantiation and magic-method invocation cannot be filtered after the fact. Safer alternatives such as json_decode() or unserialize() with an allowed_classes allowlist were not used.

Attack Vector

Exploitation requires network access and low-privilege authentication, typically a subscriber-level WordPress account. The attacker submits a request to a Question Answer plugin endpoint containing a serialized PHP object payload. The plugin deserializes the payload, instantiating attacker-chosen classes and triggering magic methods. By chaining gadgets from WordPress core or co-installed plugins, the attacker pivots from object instantiation to arbitrary file writes, command execution, or database manipulation.

No public proof-of-concept exploit has been published in Exploit-DB or CISA KEV at this time. The Patchstack advisory provides additional vendor-coordinated detail.

Detection Methods for CVE-2025-32647

Indicators of Compromise

HTTP POST requests to Question Answer plugin endpoints containing serialized PHP markers such as O:, a:, or s: in parameter values
Unexpected creation or modification of PHP files under wp-content/uploads/ or plugin directories on affected sites
New or modified WordPress administrator accounts created shortly after suspicious plugin requests
Outbound network connections originating from the PHP-FPM or web server worker process to unfamiliar hosts

Detection Strategies

Inspect web access logs for request bodies containing the regex pattern O:[0-9]+:"[A-Za-z_]+": targeting question-answer URLs
Monitor PHP error logs for __wakeup, __destruct, or unserialize-related warnings tied to plugin scripts
Compare plugin file hashes against the official 1.2.73 release to identify post-exploitation tampering

Monitoring Recommendations

Enable WordPress audit logging for low-privilege account activity, especially repeated submissions to question-answer endpoints
Alert on web server processes spawning child processes such as sh, bash, php -r, or curl
Track filesystem changes in wp-content/plugins/question-answer/ and the WordPress uploads directory in real time

How to Mitigate CVE-2025-32647

Immediate Actions Required

Identify all WordPress instances running the Question Answer plugin at version 1.2.73 or earlier
Upgrade to a vendor-released version higher than 1.2.73 once published, or deactivate and remove the plugin if no fix is available
Rotate WordPress secret keys in wp-config.php and force password resets for low-privilege accounts that could have been used to deliver payloads
Audit the site for unauthorized administrator accounts, scheduled tasks, and modified PHP files

Patch Information

Review the Patchstack Vulnerability Report for the current fixed version and vendor coordination status. Apply the vendor patch through the WordPress plugin updater and verify the installed version after upgrade.

Workarounds

Temporarily deactivate the question-answer plugin until a patched release is installed
Restrict access to plugin endpoints using a web application firewall (WAF) rule that blocks serialized PHP payloads in request parameters
Limit user registrations and review existing subscriber-level accounts to reduce the authenticated attack surface

bash

# Example WAF rule (ModSecurity) to block serialized PHP payloads to the plugin
SecRule REQUEST_URI "@contains /question-answer/" \
  "chain,id:1003264,phase:2,deny,status:403,log,msg:'Potential PHP object injection CVE-2025-32647'"
  SecRule ARGS|REQUEST_BODY "@rx O:[0-9]+:\"[A-Za-z_\\\\]+\":[0-9]+:" "t:none"