WordPress Plugin Vulnerabilities
BP Profile Search < 4.6 - PHP Object Injection
Description
The plugin bp-profile-search insecurely trusts serialized data submitted over HTTP requests. This opens up the site to a PHP object injection vulnerability potential exploit vector.
This vulnerability was patched in version 4.6, information is being released now as a disclosure period has expired.
Proof of Concept
Affects Plugins
Fixed in 4.6 References
Classification
Type
OBJECT INJECTION
OWASP top 10
CWE
Miscellaneous
Submitter
Robert R
Submitter website
Submitter twitter
Verified
No
WPVDB ID
Timeline
Publicly Published
2016-12-09 (about 9 years ago)
Added
2016-12-11 (about 9 years ago)
Last Updated
2019-11-01 (about 6 years ago)
WPScan 