Unauthenticated Attackers Can Inject PHP Object via Deserialization in WPBeginner's Last Viewed Posts Plugin

CVE-2024-3070

Summary

The Last Viewed Posts plugin for WordPress, developed by WPBeginner, is susceptible to a PHP Object Injection vulnerability in all versions up to and including 1.0.0. This vulnerability arises from the deserialization of untrusted data from the LastViewedPosts Cookie, allowing unauthenticated attackers to inject arbitrary PHP objects. There is no known proof-of-concept (POP) chain directly related to this plugin; however, if it coexists with any additional vulnerable plugins or themes on the WordPress installation, it could potentially enable attackers to execute various malicious actions such as deleting arbitrary files, accessing sensitive information, or executing unauthorized code.

References