CVE-2025-14476

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14476", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-10T18:32:10.966Z", "datePublished": "2025-12-13T04:31:24.887Z", "dateUpdated": "2026-04-08T16:50:57.032Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:57.032Z"}, "affected": [{"vendor": "unitecms", "product": "Doubly \u2013 Cross Domain Copy Paste for WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.46", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Doubly \u2013 Cross Domain Copy Paste for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.46 via deserialization of untrusted input from the content.txt file within uploaded ZIP archives. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary code, delete files, retrieve sensitive data, or perform other actions depending on the available gadgets. This is only exploitable by subscribers, when administrators have explicitly enabled that access."}], "title": "Doubly <= 1.0.46 - Authenticated (Subscriber+) PHP Object Injection via ZIP File Import", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b2c3987-fe7e-426d-8398-acdd6fa3a3dd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/doubly/trunk/inc_php/functions.class.php#L1040"}, {"url": "https://plugins.trac.wordpress.org/browser/doubly/tags/1.0.46/inc_php/functions.class.php#L1040"}, {"url": "https://plugins.trac.wordpress.org/browser/doubly/trunk/inc_php/importer.class.php#L2536"}, {"url": "https://plugins.trac.wordpress.org/browser/doubly/tags/1.0.46/inc_php/importer.class.php#L2536"}, {"url": "https://plugins.trac.wordpress.org/changeset/3426214/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-502 Deserialization of Untrusted Data", "cweId": "CWE-502", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Bart\u0142omiej Bergier"}], "timeline": [{"time": "2025-12-12T16:08:49.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:21:11.949201Z", "id": "CVE-2025-14476", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:34:08.135Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14476", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-15T15:21:11.949201Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:21:12.999Z"}}], "cna": {"title": "Doubly <= 1.0.46 - Authenticated (Subscriber+) PHP Object Injection via ZIP File Import", "credits": [{"lang": "en", "type": "finder", "value": "Bart\u0142omiej Bergier"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "unitecms", "product": "Doubly \u2013 Cross Domain Copy Paste for WordPress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.46"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-12T16:08:49.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b2c3987-fe7e-426d-8398-acdd6fa3a3dd?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/doubly/trunk/inc_php/functions.class.php#L1040"}, {"url": "https://plugins.trac.wordpress.org/browser/doubly/tags/1.0.46/inc_php/functions.class.php#L1040"}, {"url": "https://plugins.trac.wordpress.org/browser/doubly/trunk/inc_php/importer.class.php#L2536"}, {"url": "https://plugins.trac.wordpress.org/browser/doubly/tags/1.0.46/inc_php/importer.class.php#L2536"}, {"url": "https://plugins.trac.wordpress.org/changeset/3426214/"}], "descriptions": [{"lang": "en", "value": "The Doubly \u2013 Cross Domain Copy Paste for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.46 via deserialization of untrusted input from the content.txt file within uploaded ZIP archives. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary code, delete files, retrieve sensitive data, or perform other actions depending on the available gadgets. This is only exploitable by subscribers, when administrators have explicitly enabled that access."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:57.032Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14476", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:50:57.032Z", "dateReserved": "2025-12-10T18:32:10.966Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-13T04:31:24.887Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Doubly \u2013 Cross Domain Copy Paste for WordPress", "vendor": "unitecms", "versions": [{"lessThanOrEqual": "1.0.46", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Doubly \u2013 Cross Domain Copy Paste for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.46 via deserialization of untrusted input from the content.txt file within uploaded ZIP archives. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary code, delete files, retrieve sensitive data, or perform other actions depending on the available gadgets. This is only exploitable by subscribers, when administrators have explicitly enabled that access."}, {"lang": "es", "value": "El plugin de WordPress Doubly - Cross Domain Copy Paste for WordPress es vulnerable a la Inyecci\u00f3n de Objetos PHP en todas las versiones hasta la 1.0.46 (inclusive), a trav\u00e9s de la deserializaci\u00f3n de entrada no confiable del archivo content.txt dentro de archivos ZIP subidos. Esto permite a atacantes autenticados, con acceso de nivel Suscriptor y superior, inyectar un Objeto PHP. La presencia adicional de una cadena POP permite a los atacantes ejecutar c\u00f3digo arbitrario, eliminar archivos, recuperar datos sensibles o realizar otras acciones dependiendo de los gadgets disponibles. Esto solo es explotable por suscriptores, cuando los administradores han habilitado expl\u00edcitamente ese acceso."}], "id": "CVE-2025-14476", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14476", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T15:21:11.949201Z", "version": "2.0.3"}}]}, "published": "2025-12-13T16:16:50.640", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/doubly/tags/1.0.46/inc_php/functions.class.php#L1040"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/doubly/tags/1.0.46/inc_php/importer.class.php#L2536"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/doubly/trunk/inc_php/functions.class.php#L1040"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/doubly/trunk/inc_php/importer.class.php#L2536"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3426214/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/4b2c3987-fe7e-426d-8398-acdd6fa3a3dd?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:12:41.698927+00:00", "value": {"mitigation_remediation": ["Upgrade the Doubly plugin to the latest available version to eliminate the vulnerable deserialization logic.", "Restrict the ZIP import privilege to administrator roles only; disable this capability for Subscribers and other non\u2011admin users.", "If an immediate upgrade cannot be performed, disable the ZIP import feature or uninstall the Doubly plugin until a secure version is available."], "summary": {"action": "Apply Patch", "impact": "Arbitrary code execution via PHP Object Injection"}, "threat_synthesis": {"affected_systems": "All installations of the Doubly \u2013 Cross Domain Copy Paste for WordPress plugin up to and including version 1.0.46 are affected. The status of later versions (e.g., 1.0.47) is not explicitly stated in the provided data.", "description_and_impact": "The Doubly plugin for WordPress contains a PHP Object Injection flaw that activates when a user with at least Subscriber permissions uploads a ZIP archive containing a malicious content.txt file. The plugin blindly deserializes this file, allowing an attacker who has both authentication and the import capability to inject a crafted PHP object. If a PHP object\u2011payload chain is present, the attacker can achieve remote code execution, delete files, exfiltrate data, or otherwise manipulate the site. This weakness is identified as CWE\u2011502 and enables the attacker to compromise the confidentiality, integrity or availability of the WordPress installation, but only while the vulnerable import functionality is enabled for non\u2011administrator roles.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 8.8, indicating high overall severity, while the EPSS score is below 1%, suggesting a low likelihood of exploitation in the wild. The flaw is not currently listed in the CISA KEV catalogue. Exploitation requires authentication with a Subscriber\u2011level role and the ability to upload ZIP files, which some site administrators enable. Attackers can use the deserialized object to launch arbitrary code, delete or steal files, or manipulate content, all of which are feasible only on sites that have retained the vulnerable plugin and granted import rights to subscribers."}}}}, "created": "2025-12-14T21:14:58.767681+00:00", "updated": "2026-04-22T00:15:03.775809+00:00", "vendors": ["unitecms", "unitecms$PRODUCT$doubly", "wordpress", "wordpress$PRODUCT$wordpress"]}