WordPress WebinarIgnition Plugin <= 3.05.0 is vulnerable to PHP Object Injection
CVE-2023-51422

9.9CRITICAL

Key Information:

Vendor
WordPress
Status
Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition
Vendor
CVE Published:
29 December 2023

Summary

A deserialization vulnerability exists in the Saleswonder Team Webinar Plugin, which allows attackers to exploit untrusted data during object deserialization. This issue can compromise the security of the application and potentially lead to unauthorized actions within the platform. Affected versions range from n/a through 3.05.0, making it crucial for users to review and update their installations to mitigate risks.

Affected Version(s)

Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition <= 3.05.0

References

https://patchstack.com/database/vulnerability/webinar-ign...
vdb-entry

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rafie Muhammad (Patchstack)
.