Description
This web application is using Object Reflection in an insecure way. Object Reflection is a programming technique used to inspect and change the behavior of a program at runtime. Object Reflection allows instantiation of new objects, methods, and get/set operations on class variables dynamically at run time without having prior knowledge of its implementation.
It was determined that an attacker can control the class name to be instantiated via externally-controlled user input.
Remediation
Apply strict input validation by using allowlists or indirect selection to ensure that the user is only selecting allowable classes or code.
References
Related Vulnerabilities
WordPress Plugin HM Multiple Roles Security Bypass (1.2)
WordPress Plugin Contact Form 7 Multi-Step Forms Security Bypass (3.0.8)
WordPress Plugin WP Import Export Lite Security Bypass (3.9.4)
WordPress Plugin YITH WooCommerce Product Bundles Security Bypass (1.1.15)
WordPress Plugin WordPress Social Stream Security Bypass (1.5.15)