Description

WordPress Plugin PWAMP is prone to a vulnerability that lets remote attackers inject and execute arbitrary code because the application fails to sanitize user-supplied input before being passed to the unserialize() PHP function. Attackers can possibly exploit this issue to execute arbitrary PHP code within the context of the affected webserver process. WordPress Plugin PWAMP version 1.0.0 is vulnerable.

Remediation

Update to plugin version 1.0.1 or latest

References

https://www.pluginvulnerabilities.com/2018/02/22/our-proactive-monitoring-caught-a-php-object-injection-vulnerability-in-a-another-brand-new-plugin/

https://plugins.svn.wordpress.org/pwamp/trunk/readme.txt

Related Vulnerabilities

WordPress Plugin QueryWall:Plug'n Play Firewall Cross-Site Scripting (1.1.0)

WordPress Plugin WP Post to PDF Enhanced Cross-Site Scripting (1.0.5)

phpMyFAQ Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2005-3047)

Dot CMS Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2017-11466)

WordPress Plugin GoDaddy Email Marketing Cross-Site Request Forgery (1.1.2)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update CWE-915