Vulnerable WordPress Plugin Access (PHP Object Injection)

Ethan Andrews@eandrews

•updated Jun 10, 2026•3•0•7

Detects HTTP requests attempting to access known vulnerable endpoints or submit potentially malicious serialized data payloads to specific vulnerable WordPress plugins identified in recent CVEs (CVE-2025-7697, CVE-2025-7384, CVE-2025-6464, CVE-2025-6742). This rule specifically looks for common PHP serialized object ('O:') or array ('a:') syntax indicators within the URI query string when targeting known vulnerable plugin paths.