Vulnerability in Hubbub Social Sharing Buttons Plugin Allows PHP Object Injection

CVE-2024-2501

Summary

The Hubbub Lite – Fast, Reliable Social Sharing Buttons plugin for WordPress contains a vulnerability that permits PHP Object Injection due to improper handling of untrusted input via the 'dpsp_maybe_unserialize' function. Authenticated attackers with contributor access or higher can exploit this vulnerability to inject PHP Objects. Although the plugin does not contain a native PHP Object Injection Chain (POP), the presence of additional plugins or themes with exploitable chains poses a risk. Successful exploitation could lead to the deletion of arbitrary files, unauthorized retrieval of sensitive information, or remote code execution.

References