CVE-2024-5488 SEOPress < 7.9 - Unauthenticated Object Injection

2024-07-0906:00:04

WPScan

github.com

cve-2024-5488

seopress

wordpress

plugin

unauthenticated

object injection

rest api

vulnerability

gadget chains

site compromise

AI Score

7.1

Confidence

High

SSVC

Exploitation

none

Automatable

yes

Technical Impact

total

JSON

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:a:seopress:seopress:*:*:*:*:*:*:*:*"
    ],
    "vendor": "seopress",
    "product": "seopress",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "7.9",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  }
]