8.8
CVE-2023-5583
- EPSS 0.52%
- Veröffentlicht 30.10.2023 14:15:10
- Zuletzt bearbeitet 21.11.2024 08:42:04
- Quelle security@wordfence.com
- CVE-Watchlists
- Unerledigt
LoginWP Simple Galleries <= 1.34 - Authenticated (Contributor+) PHP Object Injection
The WP Simple Galleries plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.34 via deserialization of untrusted input from the 'wpsimplegallery_gallery' post meta via 'wpsgallery' shortcode. This allows authenticated attackers, with contributor-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Mögliche Gegenmaßnahme
WP Simple Galleries: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
WP Simple Galleries
Version
*-1.34
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Maca134 ≫ Wp Simple Galleries SwPlatformwordpress Version <= 1.34
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.52% | 0.66 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|
| security@wordfence.com | 8.8 | 2.8 | 5.9 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
|