CVE-2025-14476 is a PHP Object Injection vulnerability in the Doubly – Cross Domain Copy Paste for WordPress plugin (versions up to 1.0.46). It arises from deserialization of untrusted data contained in the content.txt file within uploaded ZIP archives. Authenticated attackers with Subscriber-level privileges or higher can inject malicious PHP objects. The presence of a POP (Property Oriented Programming) chain enables attackers to execute arbitrary code, delete files, or retrieve sensitive information depending on available gadgets. Exploitation requires that administrators have explicitly enabled Subscriber-level access to the plugin's functionality.

Successful exploitation allows authenticated users with Subscriber-level access or above to execute arbitrary PHP code on the server, delete files, and access sensitive data. This can lead to full compromise of the affected WordPress installation. The vulnerability has a CVSS v3.1 score of 8.8, indicating high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should consider restricting Subscriber-level access to the plugin's features or disabling the plugin entirely if Subscriber access is enabled. Monitoring for suspicious activity related to plugin usage is also advisable.