PHP Object Injection Vulnerability in GDPR CCPA Compliance Support Plugin for WordPress

CVE-2020-36718

What is CVE-2020-36718?

The GDPR CCPA Compliance Support plugin for WordPress is susceptible to a PHP Object Injection vulnerability due to improper handling of untrusted input during the deserialization process. Specifically, the 'njt_gdpr_allow_permissions' parameter can be exploited by unauthenticated attackers, potentially allowing them to inject malicious PHP objects into the application. This vulnerability affects all versions of the plugin up to and including 2.3. It is crucial for users to take immediate action by updating to the latest version to mitigate the risk of exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References