CVE-2025-2332 is a critical PHP Object Injection vulnerability in the Export All Posts, Products, Orders, Refunds & Users WordPress plugin (versions up to 2.13). It arises from unsafe deserialization of untrusted input in the 'returnMetaValueAsCustomerInput' function. Exploitation depends on the presence of a PHP Object Injection gadget chain in other installed plugins or themes. If such a chain is present, attackers may perform destructive or unauthorized actions including arbitrary file deletion, data disclosure, or code execution. The vulnerability has a CVSS 3.1 base score of 9.8, indicating high impact on confidentiality, integrity, and availability. No patch or remediation details are provided, and no exploits are known in the wild.

This vulnerability can lead to critical impacts including complete compromise of the affected WordPress site if exploited. However, exploitation requires an additional gadget chain in other installed plugins or themes. Without such a chain, the vulnerability cannot be leveraged to cause harm. If exploited, attackers could delete files, access sensitive information, or execute arbitrary code, severely affecting confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider removing or disabling the vulnerable plugin if possible. Additionally, review installed plugins and themes for known gadget chains that could enable exploitation. Monitor vendor channels for updates or patches addressing this vulnerability.