CVE-2025-14476— Doubly <= 1.0.46 - Authenticated (Subscriber+) PHP Object Injection via ZIP File Import
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-14476
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Doubly <= 1.0.46 - Authenticated (Subscriber+) PHP Object Injection via ZIP File Import
Source: NVD (National Vulnerability Database)
Vulnerability Description
The Doubly – Cross Domain Copy Paste for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.46 via deserialization of untrusted input from the content.txt file within uploaded ZIP archives. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary code, delete files, retrieve sensitive data, or perform other actions depending on the available gadgets. This is only exploitable by subscribers, when administrators have explicitly enabled that access.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
可信数据的反序列化
Source: NVD (National Vulnerability Database)
Vulnerability Title
WordPress plugin Doubly – Cross Domain Copy Paste for WordPress 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台具有在基于PHP和MySQL的服务器上架设个人博客网站的功能。WordPress plugin是一个应用插件。 WordPress plugin Doubly – Cross Domain Copy Paste for WordPress 1.0.46及之前版本存在代码问题漏洞，该漏洞源于对上传的ZIP存档中content.txt文件的反序列化不当，可能导致P
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| unitecms | Doubly – Cross Domain Copy Paste for WordPress | * ~ 1.0.46 | - |
II. Public POCs for CVE-2025-14476
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-14476
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same vendor: unitecms
- CVE-2026-4659
Unlimited Elements For Elementor <= 2.0.6 - Authenticated (C - CVE-2026-2724
Unlimited Elements For Elementor <= 2.0.5 - Unauthenticated - CVE-2025-14274
Unlimited Elements for Elementor <= 2.0.1 - Authenticated (C - CVE-2025-13692
Unlimited Elements For Elementor and Unlimited Elements For - CVE-2025-8603
Unlimited Elements For Elementor <= 1.5.148 - Authenticated
Same weakness: CWE-502
- CVE-2026-44126
Insecure deserialization - CVE-2026-5127
User Frontend: AI Powered Frontend Posting, User Directory, - CVE-2026-41586
ObjectInputStream.readObject() without ObjectInputFilter in - CVE-2026-34084
PhpSpreadsheet SSRF and RCE via PHP stream wrappers in IOFac - CVE-2026-7712
MindsDB Pickle pickle.loads deserialization
V. Comments for CVE-2025-14476
No comments yet