CVE-2025-47536: Content Egg Deserialization Vulnerability

CVE-2025-47536 Overview

CVE-2025-47536 is a PHP Object Injection vulnerability in the keywordrush Content Egg plugin for WordPress. The flaw stems from insecure deserialization of untrusted data [CWE-502] and affects all versions of Content Egg up to and including 7.0.0. An authenticated attacker with high privileges can inject crafted serialized PHP objects to trigger arbitrary code paths during the unserialize operation. Successful exploitation impacts confidentiality, integrity, and availability of the affected WordPress site. The vulnerability was published to the National Vulnerability Database (NVD) on August 14, 2025 and cataloged by Patchstack.

Critical Impact

Authenticated object injection in Content Egg ≤ 7.0.0 enables high-privilege attackers to abuse PHP deserialization for full compromise of the WordPress instance.

Affected Products

• keywordrush Content Egg plugin for WordPress, versions up to and including 7.0.0
• WordPress sites that have installed and activated Content Egg ≤ 7.0.0
• Hosting environments where Content Egg processes serialized input from authenticated users

Discovery Timeline

• 2025-08-14 - CVE-2025-47536 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47536

Vulnerability Analysis

The Content Egg plugin passes attacker-controllable input to a PHP unserialize() operation without validating the structure or origin of the serialized data. PHP deserialization reconstructs object instances and invokes magic methods such as __wakeup(), __destruct(), and __toString() during object lifecycle events. An attacker who controls the serialized payload can chain existing classes available in WordPress core, the plugin, or other active plugins to form a property-oriented programming (POP) chain. The resulting chain can execute arbitrary code, write files, or modify database records under the privileges of the PHP worker process.

Root Cause

The root cause is improper handling of untrusted input passed to deserialization routines in Content Egg versions up to 7.0.0. The plugin does not enforce allow-listing of expected classes through the allowed_classes option of unserialize(), nor does it use a safe alternative such as json_decode(). Any serialized string reaching the vulnerable sink is reconstructed as live PHP objects.

Attack Vector

Exploitation requires network access to the WordPress admin surface and an authenticated session with high privileges. The attacker submits a serialized PHP payload through a plugin parameter that is later passed to unserialize(). When the payload is processed, magic methods of gadget classes fire in sequence, leading to attacker-controlled behavior. No user interaction is needed beyond the attacker's own authenticated request. Refer to the Patchstack CVE Advisory for additional technical context.

Detection Methods for CVE-2025-47536

Indicators of Compromise

• HTTP POST requests to Content Egg admin endpoints containing serialized PHP markers such as O:, a:, or s: followed by length-prefixed strings
• Unexpected child processes spawned by the PHP-FPM or web server user after Content Egg admin activity
• New or modified PHP files in wp-content/plugins/content-egg/ or wp-content/uploads/ without a corresponding deployment event
• WordPress administrator accounts created or escalated outside of change windows

Detection Strategies

• Inspect web server access logs for authenticated requests to Content Egg endpoints containing serialized object signatures
• Hunt for anomalous file writes and outbound network connections originating from the PHP process during Content Egg usage
• Correlate WordPress audit logs with EDR telemetry to identify privileged actions following plugin parameter submissions
• Apply web application firewall (WAF) signatures that flag PHP serialized payloads in request bodies and query strings

Monitoring Recommendations

• Enable verbose logging on WordPress administrator actions and Content Egg configuration changes
• Monitor integrity of plugin and theme directories with file integrity monitoring
• Forward web server, PHP, and WordPress logs to a centralized analytics platform for correlation and retention
• Alert on creation of administrator users, scheduled tasks, or new cron entries on WordPress hosts

How to Mitigate CVE-2025-47536

Immediate Actions Required

• Upgrade Content Egg to a version later than 7.0.0 that addresses CVE-2025-47536
• Audit the WordPress user list and revoke unused administrator and editor accounts
• Rotate credentials, API keys, and session tokens for all privileged WordPress users
• Review recent changes to plugins, themes, options, and scheduled tasks for signs of tampering

Patch Information

A fixed release is referenced in the Patchstack CVE Advisory. Site operators should update Content Egg to the latest version available from the vendor and verify the installed version through the WordPress plugins screen.

Workarounds

• Deactivate and remove the Content Egg plugin until the patched version is deployed
• Restrict WordPress admin access to trusted IP ranges using web server or WAF rules
• Enforce multi-factor authentication for all WordPress accounts with manage_options capability
• Block HTTP requests containing PHP serialized object patterns at the WAF or reverse proxy layer

# Example WAF rule fragment to block PHP serialized object payloads
# (ModSecurity-style pseudo-rule)
SecRule ARGS "@rx (?:^|&)[^=]+=O:\d+:\"[A-Za-z0-9_\\]+\":\d+:" \
    "id:1004753,phase:2,deny,log,status:403,\
    msg:'Possible PHP object injection payload (CVE-2025-47536)'"