Gravitate QA Tracker <= 1.2.1 - Unauthenticated PHP Object Injection

The plugin gravitate-qa-tracker insecurely trusts serialized data submitted over HTTP requests. This opens up the site to a PHP object injection vulnerability potential exploit vector.

PoC

Attack is exploitable over HTTP requests to sites with the gravitate-qa-tracker Plugin. The original researcher notified WordPress Plugins team.