CVE-2025-15672
Chama < 1.0.13 - Unauthenticated PHP Object Injection
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The ChamaWP WordPress plugin before 1.0.13 does not properly validate user input before passing it to a PHP deserialization function, allowing unauthenticated attackers to inject arbitrary PHP objects, which could lead to remote code execution when a suitable gadget chain is present via other installed code.
| Vendor | unknown |
| Product | chamawp |
| Published | Aug 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown chamawp
Be the first to know when new unknown vulnerabilities affecting unknown chamawp are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / ChamaWP
0 < 1.0.13
References
Credits
Khaled Alenazi (Nxploited) WPScan