CVE-2025-23914: Critical PHP Object Injection in Muzaara Google Ads Report Plugin

Overview

CVE-2025-23914 highlights a critical vulnerability in the Muzaara Google Ads Report plugin for WordPress, affecting versions up to and including 3.1. The issue allows PHP Object Injection through the deserialization of untrusted data, potentially enabling full system compromise.

What is PHP Object Injection?

PHP Object Injection is a security vulnerability that occurs when user-controllable data is passed to the unserialize() function in PHP. This allows attackers to inject maliciously crafted objects, leading to the execution of code, data manipulation, or even complete application takeover—especially if vulnerable classes with magic methods are present.

This flaw is categorized under CWE-502: Deserialization of Untrusted Data and maps to CAPEC-586: Object Injection.

Technical Details

The plugin fails to properly validate or sanitize serialized data inputs, exposing an unsafe deserialization vector. Since this vulnerability:

• Requires no authentication
• Is exploitable over the network
• Needs no user interaction

It presents an exceptionally high risk for WordPress site operators.

CVSS Score and Severity

The vulnerability has been assigned a CVSS v3.1 score of 9.8 (Critical):

• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Privileges Required: None
• User Interaction: None
• Impact: High on confidentiality, integrity, and availability

This indicates a high-impact vulnerability that can be exploited remotely with minimal effort.

SSVC Assessment

Based on the Stakeholder-Specific Vulnerability Categorization (SSVC) by CISA, the flaw is:

• Not yet known to be exploited
• Highly automatable
• Technically impactful to a total extent

These indicators underscore the urgent need for immediate remediation.

Mitigation

Administrators using the Muzaara Google Ads Report plugin should:

• Immediately update or disable the plugin if no patch is available
• Audit their WordPress installation for suspicious serialized payloads
• Implement WAF rules to block known deserialization exploits

References

• Patchstack Security Advisory

Due to the high severity and ease of exploitation, organizations should treat this vulnerability as a top-priority fix.