PHP object injection is a vulnerability where untrusted input is fed into PHP object handling, usually through functions such as unserialize(). If attacker-controlled data can shape an object's properties or class type, PHP may invoke magic methods like __wakeup() or __destruct() in ways the developer did not intend. By itself, the flaw is a dangerous trust boundary problem; with the right gadget chain, it can become file deletion, authentication bypass, server-side request forgery, or remote code execution.
This matters because many PHP applications, including WordPress plugins, store complex state in serialized form. A small validation mistake in widget settings, cache data, or copied configuration can expose an object-injection path. Defenders reduce risk by avoiding unserialize() on attacker input, using allowed_classes restrictions, signing serialized data, and reviewing code for reachable gadget chains. Attackers look for places where malformed cookies, form fields, or API parameters are trusted as objects instead of plain data.