CVE-2023-26326

2023-02-2300:00:00

tenable

www.cve.org

buddyforms

wordpress

unauthenticated

insecure deserialization

phar wrapper

arbitrary php objects

malicious actions

pop chain

9.8 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

65.6%

JSON

The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker could leverage this issue to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "BuddyForms WordPress Plugin",
    "versions": [
      {
        "version": "All versions prior to version 2.7.8",
        "status": "affected"
      }
    ]
  }
]