Deserialization of Untrusted Data Vulnerability Affects WooBuddy
CVE-2024-32603

8.5HIGH

Key Information:

Vendor
WordPress
Status
Woobuddy
Vendor
CVE Published:
18 April 2024

Summary

A deserialization of untrusted data vulnerability exists in ThemeKraft's WooBuddy plugin, affecting versions up to 3.4.20. This issue can allow an attacker to exploit the insecure deserialization process, potentially leading to remote code execution or other unauthorized actions. Users of the WooBuddy plugin are advised to implement immediate security measures and update to the latest version to mitigate risks associated with this vulnerability.

Affected Version(s)

WooBuddy <= 3.4.20

References

https://patchstack.com/database/vulnerability/wc4bp/wordp...
vdb-entry

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LVT-tholv2k (Patchstack Alliance)
.