WordPress Plugin Vulnerabilities

Option Tree < 2.7.0 - PHP Object Injection

Description

The OptionTree WordPress plugin was affected by a PHP Object Injection security vulnerability.

Affects Plugins

Plugin icon
option-tree
Fixed in 2.7.0

References

CVE
CVE-2019-15319

Classification

Type
OBJECT INJECTION
OWASP top 10
A8: Insecure Deserialization
CWE
CWE-502
CVSS
9.8 (critical)

Miscellaneous

Verified
Yes
WPVDB ID
3df6b97d-6f4c-4c2e-b150-7ee790e0d177

Timeline

Publicly Published
2019-04-16 (about 7 years ago)
Added
2019-08-22 (about 6 years ago)
Last Updated
2020-10-13 (about 5 years ago)

Other

Published
Title
Published
2025-03-04
Title
WooCommerce Recover Abandoned Cart <= 24.3.0 - Unauthenticated PHP Object Injection
Published
2025-09-02
Title
Fluent Forms 5.1.16 - 6.1.0 - Subscriber+ PHP Object Injection To Arbitrary File Read
Published
2026-03-23
Title
Goldish < 3.47 - Unauthenticated PHP Object Injection
Published
2026-03-09
Title
Beelove | Honey Production and Sweets Online Store WordPress Theme <= 1.2.6 - Unauthenticated PHP Object Injection
Published
2025-08-23
Title
PDF for Contact Form 7 < 6.5.1 - Authenticated (Subscriber+) PHP Object Injection