6.5

CVE-2024-3591

Exploit

WordPress Geo Controller < 8.6.5 - PHP Object Injection

Geo Controller <= 8.6.4 - Unauthenticated PHP Object Injection via shortcode REST API Route

The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.
Mögliche Gegenmaßnahme
Geo Controller: Update to version 8.6.5, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Infinitumform ≫ Geo Controller SwPlatformwordpress Version < 8.6.5
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Geo Controller
Version *-8.6.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.49% 0.381
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
134c704f-9b21-4f2e-91b3-4a467353bcc0 6.5 3.9 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CWE-502 Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

https://wpscan.com/vulnerability/f85d8b61-eaeb-433c-b857-06ee4db5c7d5/
Third Party Advisory
Exploit
https://www.wordfence.com/threat-intel/vulnerabilities/id/6f00bbab-ef84-42cf-baa7-23c434416981
Third Party Advisory