String Locator < 2.6.8 - Unauthenticated PHP Object Injection via Database Editor

Description

The plugin does not restrict the classes allowed when deserializing the content of a database row saved through its database editor, allowing unauthenticated attackers to store a serialized PHP object that is instantiated when an administrator later opens and saves that row. If a suitable POP chain is present via another installed plugin or theme, this can lead to arbitrary file deletion, sensitive data disclosure or remote code execution.