PHP Object Injection Vulnerability in Go Pricing WordPress Plugin

CVE-2023-2500

Summary

The Go Pricing - WordPress Responsive Pricing Tables plugin is vulnerable to a PHP Object Injection due to improper handling of untrusted input in the 'data' parameter of the 'go_pricing' shortcode. This security flaw specifically impacts versions up to and including 3.3.19. Authenticated attackers with subscriber-level permissions can exploit this vulnerability to inject malicious PHP objects. While the plugin does not possess a direct Property-Oriented Programming (POP) chain, the introduction of such a chain through other plugins or themes could enable attackers to execute arbitrary code, delete files, or access sensitive information.

References