CVE-2025-39527: Rating by BestWebSoft Object Injection

CVE-2025-39527 Overview

CVE-2025-39527 is a PHP Object Injection vulnerability in the Rating by BestWebSoft WordPress plugin (rating-bws). The flaw stems from insecure deserialization of untrusted data [CWE-502] and affects all versions through 1.7. An authenticated attacker with low privileges can submit crafted serialized payloads that the plugin unserializes, enabling object injection against the WordPress site.

Critical Impact
Successful exploitation can lead to remote code execution, data tampering, or full compromise of the WordPress instance when suitable PHP gadget chains are available in the application or other installed plugins.

Affected Products

Rating by BestWebSoft (rating-bws) WordPress plugin
All versions from n/a through 1.7
WordPress sites with the plugin installed and active

Discovery Timeline

2025-04-17 - CVE-2025-39527 published to the National Vulnerability Database (NVD)
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-39527

Vulnerability Analysis

The Rating by BestWebSoft plugin processes user-controlled input through PHP's unserialize() function without validating the data source or structure. When PHP deserializes attacker-controlled data, it instantiates arbitrary objects and triggers magic methods such as __wakeup() and __destruct() during the deserialization lifecycle.

This behavior allows attackers to abuse existing classes loaded in the WordPress runtime to construct gadget chains. Depending on classes available in WordPress core, the plugin itself, or co-installed plugins and themes, the chain can result in arbitrary file writes, SQL execution, or command execution.

The attack requires network access and authenticated low-privilege credentials, but no user interaction. Confidentiality, integrity, and availability are all impacted on a successful exploit. The EPSS score is approximately 0.287% as of the most recent scoring update.

Root Cause

The root cause is the use of unserialize() on data that originates from HTTP requests, cookies, or database fields that an attacker can influence. PHP deserialization is unsafe by design when input is not strictly validated, and the plugin does not enforce JSON-based encoding or signed payloads as a safer alternative.

Attack Vector

An authenticated attacker submits a crafted serialized PHP object string to a plugin endpoint that calls unserialize(). The attacker selects a gadget chain present in the WordPress environment to escalate the object instantiation into a meaningful primitive such as file write or code execution. Refer to the Patchstack advisory for CVE-2025-39527 for vulnerability specifics.

Detection Methods for CVE-2025-39527

Indicators of Compromise

HTTP request bodies or parameters containing serialized PHP markers such as O:, a:, or s: directed at plugin endpoints under /wp-content/plugins/rating-bws/
Unexpected PHP files written under wp-content/uploads/ or plugin directories
New or modified WordPress administrator accounts not created by legitimate users
Outbound network connections from the php-fpm or web server process to unfamiliar hosts

Detection Strategies

Inspect web access logs for POST requests to rating-bws endpoints containing serialized object signatures
Monitor PHP error logs for warnings related to unserialize() and __wakeup() invocations on unknown classes
Apply web application firewall (WAF) rules that flag serialized PHP payloads inside request parameters

Monitoring Recommendations

Enable file integrity monitoring on the WordPress installation root and wp-content directory
Forward web server and PHP logs to a centralized SIEM for correlation against plugin activity baselines
Alert on the creation of administrator-role users and changes to plugin or theme files outside maintenance windows

How to Mitigate CVE-2025-39527

Immediate Actions Required

Identify all WordPress sites running the Rating by BestWebSoft plugin at version 1.7 or earlier
Deactivate and remove the plugin if a patched version is not yet available for your environment
Rotate WordPress credentials and API keys if exploitation is suspected
Audit recently created users, scheduled tasks, and modified files within wp-content

Patch Information

No fixed version is documented in the available advisory at the time of publication. Monitor the Patchstack advisory and the WordPress plugin repository for an updated release beyond version 1.7.

Workarounds

Restrict access to the WordPress admin area and authenticated plugin endpoints using IP allowlists
Deploy WAF signatures that block serialized PHP payloads in request parameters targeting the plugin
Enforce least-privilege roles so that low-privilege accounts cannot reach the vulnerable code paths
Remove the plugin entirely if its functionality is non-essential to the site

bash

# Example: block requests containing serialized PHP objects at the WAF
# ModSecurity rule (illustrative)
SecRule ARGS "@rx O:[0-9]+:\"[a-zA-Z_\\\\]+\":[0-9]+:" \
    "id:1003927,phase:2,deny,status:403,msg:'PHP object injection attempt (CVE-2025-39527)'"