CVE-2025-48134: WP Tabs Object Injection Vulnerability

CVE-2025-48134 Overview

CVE-2025-48134 is a PHP Object Injection vulnerability in the ShapedPlugin LLC WP Tabs (wp-expand-tabs-free) WordPress plugin. The flaw stems from deserialization of untrusted data and affects all versions up to and including 2.2.12. Authenticated attackers with high privileges can submit crafted serialized payloads that the plugin unsafely passes to PHP's unserialize() function. Successful exploitation can lead to arbitrary object instantiation and, when suitable PHP magic methods or gadget chains are available, full compromise of the WordPress site. The issue is tracked under CWE-502: Deserialization of Untrusted Data.

Critical Impact
Authenticated attackers can trigger PHP Object Injection in WP Tabs, leading to high impact on confidentiality, integrity, and availability of the WordPress site.

Affected Products

ShapedPlugin LLC WP Tabs (wp-expand-tabs-free) plugin for WordPress
All versions from initial release through 2.2.12
WordPress sites with the vulnerable plugin installed and activated

Discovery Timeline

2025-05-16 - CVE-2025-48134 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-48134

Vulnerability Analysis

The WP Tabs plugin processes user-supplied input through PHP's unserialize() function without validating or restricting the resulting object types. PHP Object Injection occurs when attacker-controlled serialized data is deserialized, instantiating arbitrary classes loaded in the WordPress runtime. Attackers can chain existing classes, known as POP (Property-Oriented Programming) gadgets, by leveraging magic methods such as __wakeup(), __destruct(), or __toString(). The vulnerability requires high-privilege authentication but no user interaction, and it impacts confidentiality, integrity, and availability.

Root Cause

The root cause is the unsafe handling of serialized input within the plugin's request processing logic. WP Tabs deserializes data sourced from request parameters or stored plugin options without enforcing an allowlist of expected classes through the allowed_classes option in unserialize(). This permits any class loaded by WordPress core, plugins, or themes to be instantiated through a crafted payload.

Attack Vector

The vulnerability is exploitable over the network through standard WordPress administrative interfaces. An attacker holding an account with sufficient privileges submits a serialized PHP payload to a plugin endpoint that invokes unserialize(). When combined with a gadget chain present in the WordPress environment, the deserialization can lead to file write, file read, SQL execution, or remote code execution depending on available classes. See the Patchstack WordPress Vulnerability advisory for additional context on the affected plugin functionality.

Detection Methods for CVE-2025-48134

Indicators of Compromise

HTTP requests to WP Tabs plugin endpoints containing serialized PHP markers such as O:, a:, or s: patterns in POST bodies or query strings
Unexpected creation or modification of PHP files under wp-content/uploads/ or plugin directories following requests to WP Tabs handlers
Outbound network connections initiated by wp-cron.php or plugin scripts to attacker-controlled infrastructure
New or modified WordPress administrator accounts with no corresponding audit trail

Detection Strategies

Inspect web server access logs for requests targeting WP Tabs AJAX or admin-post handlers containing serialized object signatures
Monitor PHP error logs for unserialize() warnings, __wakeup or __destruct errors, and class instantiation failures originating from the plugin path
Apply file integrity monitoring to the wp-content/plugins/wp-expand-tabs-free/ directory and core WordPress files
Correlate authenticated administrative sessions with anomalous serialized payload submissions to plugin endpoints

Monitoring Recommendations

Enable WordPress audit logging to capture plugin setting changes and privileged user activity
Forward web server, PHP, and WordPress logs to a centralized analytics platform for correlation across endpoints, identities, and web traffic
Establish alerting on process executions spawned by the PHP-FPM or web server user that deviate from baseline behavior

How to Mitigate CVE-2025-48134

Immediate Actions Required

Identify all WordPress installations running WP Tabs (wp-expand-tabs-free) version 2.2.12 or earlier
Update the plugin to a fixed version once released by ShapedPlugin LLC, or disable and remove the plugin if a patch is unavailable
Audit administrator and editor accounts for unauthorized additions or privilege changes
Rotate WordPress secrets in wp-config.php and reset credentials for privileged users

Patch Information

Review the Patchstack advisory for WP Tabs for the latest fixed version information. Apply vendor patches through the WordPress plugin updater and verify the installed version after upgrade.

Workarounds

Deactivate and remove the WP Tabs plugin until a patched release is available and verified
Restrict access to /wp-admin/ and /wp-admin/admin-ajax.php using IP allowlists or a web application firewall (WAF) rule blocking serialized PHP payloads
Enforce least privilege by reducing the number of accounts with administrator-level capabilities
Apply virtual patching rules in a WAF to inspect request bodies for serialized object markers targeting WP Tabs endpoints

bash

# Example: disable the vulnerable plugin via WP-CLI until a patch is applied
wp plugin deactivate wp-expand-tabs-free
wp plugin delete wp-expand-tabs-free