WordPress Plugin Vulnerabilities

UltimateWoo <= 0.1.10 - PHP Object Injection

Description

The plugin is using an outdated library which is affected by a PHP Object Injection issue

Affects Plugins

Plugin icon
ultimatewoo
No known fix

References

URL
https://plugins.trac.wordpress.org/browser/ultimatewoo/trunk/modules/social-login/lib/opauth/lib/Opauth/Opauth.php#L235
URL
https://plugins.trac.wordpress.org/browser/ultimatewoo/trunk/modules/social-login/lib/opauth/lib/Opauth/Opauth.php#L238

Classification

Type
OBJECT INJECTION
OWASP top 10
A8: Insecure Deserialization
CWE
CWE-502
CVSS
5.6 (medium)

Miscellaneous

Original Researcher
WPScanTeam
Verified
Yes
WPVDB ID
3d689de8-3c0c-49f0-a697-39a6dab52022

Timeline

Publicly Published
2021-05-07 (about 3 years ago)
Added
2021-05-07 (about 3 years ago)
Last Updated
2021-05-07 (about 3 years ago)

Other

Published
Title
Published
2013-09-11
Title
WordPress 3.6 - PHP Object Injection
Published
2024-05-07
Title
Advanced Ads – Ad Manager & AdSense < 1.52.2 - Authenticated (Admin+) PHP Object Injection
Published
2024-03-04
Title
Auto Refresh Single Page <= 1.1 - Authenticated (Contributor+) PHP Object Injection
Published
2017-04-27
Title
Row Seats Core < 2.68 - Unauthenticated PHP Object Injection
Published
2016-03-02
Title
Easy Digital Downloads < 2.5.8 - PHP Object Injection