PHP Object Injection Vulnerability in String Locator Plugin for WordPress
CVE-2024-10936
What is CVE-2024-10936?
The String Locator plugin for WordPress contains a vulnerability that allows for PHP Object Injection due to improper handling of untrusted input during deserialization in the 'recursive_unserialize_replace' function. This flaw affects all versions up to and including 2.6.6. Attackers can exploit this vulnerability without authentication, potentially leading to the execution of arbitrary code, deletion of files, or unauthorized access to sensitive information if a suitable PHP Object Payload (POP) chain exists via other themes or plugins installed on the same site. The exploitation is triggered when an administrator initiates a search and replace action.
Affected Version(s)
String locator * <= 2.6.6
References
EPSS Score
12% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
Vulnerability published
Vulnerability Reserved