Deserialization Vulnerability in String Locator Plugin for WordPress

CVE-2022-2434

Summary

The String Locator plugin for WordPress suffers from a deserialization vulnerability due to improper handling of the 'string-locator-path' parameter. This exploit allows unauthenticated users to invoke files via a PHAR wrapper, potentially leading to significant security breaches if a site administrator unknowingly triggers malicious actions, such as clicking on a deceptive link. For an exploit to succeed, attackers must also upload a file containing a serialized payload. This vulnerability highlights the critical importance of validating and sanitizing user inputs to prevent unwarranted access and actions within WordPress plugins.

References