Unauthenticated PHP Object Injection Vulnerability in Print Science Designer Plugin

CVE-2024-12312

Summary

The Print Science Designer plugin for WordPress is affected by a PHP Object Injection vulnerability across all versions up to and including 1.3.152. This vulnerability arises from the deserialization of untrusted input through the 'designer-saved-projects' cookie, allowing unauthenticated attackers to exploit the flaw. Although no known PHP Object Pattern (POP) chain exists within the vulnerable software, the presence of an additional plugin or theme that facilitates such a chain could grant attackers the ability to delete arbitrary files, access sensitive information, or execute malicious code.

References