Описание
The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
Ссылки
- ExploitThird Party Advisory
- ExploitThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 8.6.5 (исключая)
cpe:2.3:a:infinitumform:geo_controller:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 61%
0.00411
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-502
Связанные уязвимости
CVSS3: 6.5
github
почти 2 года назад
The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
EPSS
Процентиль: 61%
0.00411
Низкий
6.5 Medium
CVSS3
Дефекты
CWE-502