What the vulnerability does
01Description
The Doubly – Cross Domain Copy Paste for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.46 via deserialization of untrusted input from the content.txt file within uploaded ZIP archives. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary code, delete files, retrieve sensitive data, or perform other actions depending on the available gadgets. This is only exploitable by subscribers, when administrators have explicitly enabled that access.
Explanation of Vulnerability in Simple Terms
02Summary
The Doubly plugin for WordPress contains a deserialization vulnerability that allows authenticated attackers to execute arbitrary PHP code on the site. An attacker with low-level WordPress access can craft malicious serialized data that, when processed by the plugin, runs their own code with full site privileges. This affects all versions up to 1.0.46.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the WordPress site with full administrative privileges.
Potential impact on your site
04Site Impact
Complete site compromise: attackers can steal data, modify content, create admin accounts, or inject malware.
Conditions required to exploit
05Prerequisites
Attacker must have a low-level WordPress user account (subscriber or higher).
Key dates
06Disclosure timeline
December 13, 2025
CVE published
April 8, 2026
Record updated
