WPtouch < 4.3.45 - Admin+ PHP Object Injection

CVE-2022-3417

Summary

The WPtouch plugin for WordPress prior to version 4.3.45 contains a vulnerability that allows for PHP object injection through the unserialization of an imported settings file. If a user imports a malicious settings file—whether intentionally or accidentally—this could lead to severe security issues due to the exploitation of a suitable gadget chain present in the blog. It is crucial for users of the WPtouch plugin to ensure they are running an updated version to mitigate the risk of such attacks.

References