Object Injection Flaw in OptionTree Plugin for WordPress
CVE-2019-15321

9.8CRITICAL

Key Information:

Vendor
Wordpress
Status
Optiontree
Vendor
CVE Published:
22 August 2019

Summary

The OptionTree plugin for WordPress prior to version 2.7.3 contains a vulnerability that allows for Object Injection due to improper handling of serialized classes. This can potentially enable attackers to exploit the application by injecting malicious objects, which may lead to unauthorized actions within the affected system.

References

https://wordpress.org/plugins/option-tree/#developers
x_refsource_MISC
https://wpvulndb.com/vulnerabilities/9600
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.