PHP Object Injection Vulnerability in GDPR CCPA Compliance Support Plugin for WordPress

CVE-2020-36718

Summary

The GDPR CCPA Compliance Support plugin for WordPress is susceptible to a PHP Object Injection vulnerability due to improper handling of untrusted input during the deserialization process. Specifically, the 'njt_gdpr_allow_permissions' parameter can be exploited by unauthenticated attackers, potentially allowing them to inject malicious PHP objects into the application. This vulnerability affects all versions of the plugin up to and including 2.3. It is crucial for users to take immediate action by updating to the latest version to mitigate the risk of exploitation.

References