Lucene search

K
wpvulndbWpvulndbWPVDB-ID:428C25FD-B21B-4EBD-9C15-C8B645C847C3
HistoryMay 07, 2024 - 12:00 a.m.

WP Migrate Pro < 2.6.11 - Unauthenticated PHP Object Injection

2024-05-0700:00:00
wpscan.com
10
wordpress
php object injection
vulnerable plugin
unauthenticated attackers
arbitrary files
sensitive data

7.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

Description The WP Migrate Pro plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.6.10 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

CPENameOperatorVersion
eq2.6.11

7.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

Related for WPVDB-ID:428C25FD-B21B-4EBD-9C15-C8B645C847C3