Lucene search

K
wpvulndbWpvulndbWPVDB-ID:5820A101-A4B0-4E54-BFE3-93673BE99F39
HistoryFeb 08, 2024 - 12:00 a.m.

Coupon Referral Program <= 1.7.2 - Unauthenticated PHP Object Injection

2024-02-0800:00:00
wpscan.com
8
wordpress
coupon referral program
vulnerability
php object injection
unauthenticated
plugin
deserialization
attack
pop chain

7.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

Description The Coupon Referral Program plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.2 via deserialization of untrusted input. This makes it possible for unuathenitcated attackers. to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

7.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

Related for WPVDB-ID:5820A101-A4B0-4E54-BFE3-93673BE99F39