PHP Object Injection Vulnerability in String Locator Plugin for WordPress

CVE-2024-10936

Summary

The String Locator plugin for WordPress contains a vulnerability that allows for PHP Object Injection due to improper handling of untrusted input during deserialization in the 'recursive_unserialize_replace' function. This flaw affects all versions up to and including 2.6.6. Attackers can exploit this vulnerability without authentication, potentially leading to the execution of arbitrary code, deletion of files, or unauthorized access to sensitive information if a suitable PHP Object Payload (POP) chain exists via other themes or plugins installed on the same site. The exploitation is triggered when an administrator initiates a search and replace action.

References