WordPress Plugin Vulnerabilities

SiteBuilder Dynamic Components <= 1.0 - Unauthenticated PHP Object Injection

Description

The plugin insecurely trusts serialized data submitted over AJAX requests. This opens up the site to a PHP object injection vulnerability potential exploit vector.

Proof of Concept

Affects Plugins

Plugin icon
sitebuilder-dynamic-components
No known fix

References

CVE
CVE-2017-18604

Classification

Type
OBJECT INJECTION
OWASP top 10
A8: Insecure Deserialization
CWE
CWE-502
CVSS
7.5 (high)

Miscellaneous

Submitter
Robert R
Submitter website
https://pagely.com
Submitter twitter
@iamlei
Verified
No
WPVDB ID
4401d08c-a145-4be3-8514-ba794038a6d4

Timeline

Publicly Published
2017-04-27 (about 8 years ago)
Added
2017-05-21 (about 8 years ago)
Last Updated
2024-10-17 (about 1 year ago)

Other

Published
Title
Published
2023-09-13
Title
Essential Blocks <= 4.2.0 - Unauthenticated PHP Object Injection via queries
Published
2025-03-27
Title
Traveler < 3.2.1 - Unauthenticated PHP Object Injection
Published
2025-03-26
Title
Export All Posts, Products, Orders, Refunds & Users < 2.14 - Unauthenticated PHP Object Injection
Published
2026-01-27
Title
ModelTheme Addons for WPBakery and Elementor < 1.5.6 - Authenticated (Contributor+) PHP Object Injection
Published
2024-01-30
Title
WordPress < 6.4.3 - Deserialization of Untrusted Data