Overview
The Friends plugin for WordPress, a popular content management system, has been identified as being vulnerable to a specific type of attack known as PHP Object Injection. This exploit, designated as CVE-2025-7504, can allow an authenticated attacker with subscriber-level access to potentially compromise the system or leak sensitive data. The vulnerability is of particular concern to websites that have other plugins or themes installed that contain a POP (Property Oriented Programming) chain.
Vulnerability Summary
CVE ID: CVE-2025-7504
Severity: High (7.5)
Attack Vector: Network
Privileges Required: Low (Subscriber-level access)
User Interaction: Required
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
WordPress Friends Plugin | 3.5.1
How the Exploit Works
The exploit takes advantage of a vulnerability in version 3.5.1 of the Friends plugin for WordPress where the query_vars parameter is susceptible to PHP Object Injection via deserialization of untrusted input. This allows an attacker, with subscriber-level access and knowledge of the site’s SALT_NONCE and SALT_KEY, to inject a PHP Object. Notably, the vulnerability can be escalated if a POP chain is present via an additional plugin or theme, which could potentially allow the attacker to delete files, retrieve sensitive data, or execute code.
Conceptual Example Code
Here’s a conceptual HTTP POST request that an attacker might use:
POST /wp-admin/admin-ajax.php?action=friends_query_vars HTTP/1.1
Host: target.example.com
Content-Type: application/json
{ "query_vars": "serialized PHP object" }Please note that the “serialized PHP object” placeholder should be replaced with a malicious serialized PHP object that the attacker intends to inject.
Mitigation and Recommendations
Users are advised to immediately apply the vendor-released patch to fix this vulnerability. In the absence of a patch, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can serve as temporary mitigation. Furthermore, site owners should audit their installed plugins and themes for the presence of a POP chain, which can escalate the impact of this vulnerability.
