CVE-2025-47552
Published: 07 January 2026
Summary
CVE-2025-47552 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 23.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-47552 is a Deserialization of Untrusted Data vulnerability (CWE-502) in the DZS Video Gallery WordPress plugin from Digital Zoom Studio, enabling object injection. The issue affects all versions up to and including 12.39, as disclosed on January 7, 2026, with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact exploitation.
Remote attackers require no privileges, authentication, or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation could result in high confidentiality, integrity, and availability impacts, typically allowing arbitrary code execution or other severe consequences through PHP object injection in the dzs-videogallery component.
Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/dzs-videogallery/vulnerability/wordpress-dzs-video-gallery-12-25-php-object-injection-vulnerability?_s_id=cve provides details on the vulnerability, including recommended mitigations such as updating to a patched version beyond 12.39 or applying available security configurations.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-1220
Vulnerability details
Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery dzs-videogallery allows Object Injection.This issue affects DZS Video Gallery: from n/a through <= 12.39.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated RCE via deserialization/object injection in a public-facing WordPress plugin maps cleanly to exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2025-47552 by remediating the deserialization flaw through patching the DZS Video Gallery plugin to versions beyond 12.39.
Prevents object injection by validating untrusted data inputs before deserialization in the dzs-videogallery WordPress plugin component.
Boundary protection with web application firewalls or proxies can inspect and block malicious payloads targeting the remote deserialization vulnerability.