External risk intelligence

WP User Manager Object Injection Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-60245

The vulnerability affects a WordPress plugin designed for user management. Such plugins are typically installed on web servers to handle public-facing registration, login, and user profile functionality, making them directly reachable via the internet as part of the standard web application interface.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability exists in the WP User Manager plugin, allowing attackers to inject malicious code through a deserialization flaw. This could potentially lead to unauthorized system access and data compromise.

Untrusted data can be injected into the system.
User management plugin vulnerabilities are internet-facing.
Confirm plugin relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability through the internet without needing any special access. The WP User Manager plugin, when processing data, is susceptible to object injection. If an attacker can send specially crafted data to the plugin, it could lead to code execution on the server.

Accessible over the internet.
Plugin processes untrusted data.
Allows remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious PHP objects into a vulnerable system when specific conditions are met. This could potentially impact the integrity and availability of the affected user management service.

User data and system integrity.
Via deserialization of untrusted data.
Service disruption or data corruption.

Operational Fix

Recommended remediation, mitigation, and detection steps

The WP User Manager plugin, particularly versions up to and including 2.9.12, contains a critical deserialization vulnerability. This type of flaw often requires coordination between application owners responsible for the WordPress site and potentially the infrastructure or platform teams managing the web server environment. The immediate first step is to determine the scope of its presence across your digital assets, assess its business criticality and exposure, and identify the accountable application owner for remediation planning.

Confirm application and infrastructure ownership.
Verify plugin presence and exposure.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the WP User Manager plugin used for?

WP User Manager is a WordPress plugin designed to handle registration, login, and user profile management. It provides tools for site administrators to manage community or membership features, effectively extending core WordPress capabilities to allow users to sign up, log in, and interact with the site's front-end interfaces.

How does CVE-2025-60245 work?

This vulnerability is classified as CWE-502, or Deserialization of Untrusted Data. It occurs when an application takes data from an untrusted source and converts it back into an object without sufficient validation. Because the plugin blindly trusts this input, an attacker can manipulate the process to inject malicious PHP objects, potentially leading to unauthorized code execution on the server.

Can this vulnerability be triggered by any user?

The flaw is triggered when the plugin processes specially crafted data. It does not require the attacker to have an existing account or administrative privileges to initiate the attack. However, simply visiting a site does not trigger the bug; the attacker must be able to send specific, crafted input to the plugin's data processing endpoints to exploit the flaw.

Why is this plugin considered internet-facing?

According to Halo Surface Signal, because WP User Manager handles core functions like registration and login, it must be reachable by visitors. This means the plugin's code runs on public-facing infrastructure, making it directly accessible to anyone on the internet. Any vulnerability within this plugin resides on the same path used by legitimate users to interact with the site.

What steps should I take if I use this plugin?

First, identify if you are running version 2.9.12 or earlier. You should locate the application owner responsible for the site to confirm the plugin's presence and assess the risk to your infrastructure. Once identified, coordinate with your technical team to prioritize the installation of a secure version of the plugin as soon as it becomes available to protect your site's integrity.

References

patchstack.com/database/Wordpress/Plugin/wp-user-manager/vulnerabili…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.