CVE-2025-32662: uListing Object Injection Vulnerability

CVE-2025-32662 Overview

CVE-2025-32662 is a deserialization of untrusted data vulnerability affecting the Stylemix uListing plugin for WordPress. The flaw enables PHP Object Injection in all versions up to and including 2.2.0. Authenticated attackers with low-level privileges can submit crafted serialized payloads to vulnerable endpoints, triggering object instantiation through PHP magic methods. When suitable gadget chains exist in the application or its dependencies, exploitation can lead to remote code execution, data tampering, or destruction. The vulnerability is tracked under CWE-502: Deserialization of Untrusted Data.

Critical Impact
Authenticated attackers can achieve PHP Object Injection on WordPress sites running uListing <= 2.2.0, potentially leading to remote code execution and full site compromise.

Affected Products

Stylemix uListing WordPress plugin (ulisting)
All versions from n/a through <= 2.2.0
WordPress sites with the uListing plugin installed and active

Discovery Timeline

2025-04-17 - CVE-2025-32662 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32662

Vulnerability Analysis

The uListing plugin processes serialized data from untrusted sources without sufficient validation. When PHP encounters serialized input, the unserialize() function reconstructs objects and automatically invokes magic methods such as __wakeup(), __destruct(), and __toString(). Attackers can craft serialized payloads referencing classes available in the WordPress runtime to trigger unintended behavior during reconstruction.

The attack requires network access and low-privilege authentication. No user interaction is required, and successful exploitation impacts confidentiality, integrity, and availability. The vulnerability is classified under [CWE-502].

Root Cause

The root cause is the use of PHP's unserialize() on attacker-controlled input within uListing handlers. The plugin does not enforce strict type validation, signed payloads, or safe-format alternatives such as JSON. Any class loaded by WordPress core, other plugins, or themes becomes a candidate gadget for chain construction.

Attack Vector

An authenticated attacker submits a malicious serialized payload to a vulnerable uListing request handler. PHP deserializes the input and instantiates attacker-controlled objects. When a usable gadget chain exists in the runtime, the chain executes during object destruction or wake-up, enabling arbitrary file operations, database manipulation, or command execution under the web server context.

Verified exploitation code is not publicly available for this CVE. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-32662

Indicators of Compromise

HTTP POST requests to uListing endpoints containing serialized PHP markers such as O:, a:, or s: followed by class names and properties.
Unexpected PHP error log entries referencing unserialize(), __wakeup(), or __destruct() from the uListing plugin path.
New or modified files in wp-content/uploads/ or theme directories created by the web server user without corresponding administrative action.
Outbound network connections from the PHP-FPM or Apache process to unfamiliar hosts following uListing requests.

Detection Strategies

Inspect web server access logs for requests targeting uListing AJAX or REST endpoints with serialized payload signatures.
Deploy web application firewall rules that flag PHP serialization tokens within POST bodies submitted to plugin endpoints.
Correlate authentication events for low-privilege users with subsequent file system or database write activity originating from the web server process.

Monitoring Recommendations

Enable WordPress audit logging to capture plugin activity, user role changes, and option modifications.
Monitor file integrity for the wp-content/plugins/ulisting/ directory and the broader WordPress installation.
Alert on creation of new administrator accounts, scheduled cron entries, or PHP files written outside expected paths.

How to Mitigate CVE-2025-32662

Immediate Actions Required

Update the uListing plugin to the version released after 2.2.0 that addresses CVE-2025-32662 as soon as the vendor publishes a patched release.
Restrict registration and limit low-privilege account creation until patching is complete.
Audit existing user accounts for unauthorized creation or privilege changes performed during the exposure window.

Patch Information

Consult the Patchstack WordPress Vulnerability Report and the Stylemix uListing changelog for the fixed version. Apply the update through the WordPress plugin dashboard or by replacing the plugin files manually.

Workarounds

Deactivate and remove the uListing plugin until a patched release is available and deployed.
Deploy a web application firewall rule that blocks requests to uListing endpoints containing PHP serialization tokens such as O: or a:.
Enforce least privilege on WordPress accounts and require strong authentication including multi-factor authentication for all users.

bash

# Example WAF rule (ModSecurity) blocking serialized payloads to uListing endpoints
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,phase:2,deny,status:403,id:1003266,msg:'Blocked PHP serialized payload to uListing'"
    SecRule ARGS "@rx O:[0-9]+:\"[A-Za-z_\\\\]+\":[0-9]+:\{" \
        "t:none"