Advanced Database Cleaner Plugin Vulnerable to PHP Object Injection

CVE-2024-0668

Summary

The Advanced Database Cleaner plugin for WordPress is susceptible to PHP Object Injection in all versions up to and including 3.1.3. This vulnerability arises from the unsafe deserialization of untrusted input within the 'process_bulk_action' function, allowing authenticated users with admin-level access to potentially inject a PHP object. While the plugin itself does not establish a property-oriented programming (POP) chain, the presence of such a chain through additional plugins or themes can lead to significant security risks. Attackers could manipulate this flaw to delete arbitrary files, access sensitive data, or execute unauthorized code within the affected WordPress site.

References