WordPress CVEs

Description

The SEOPress WordPress plugin before 6.5.0.3 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.

Affected WordPress components

• SEOPress – AI SEO Plugin & On-site SEO Plugin · wp-seopress
  Confirmed match Active
  Before 6.5.0.3
  View on WordPress.org
• seopress Plugin · seopress
  Possible match Homeless
  Before 6.5.0.3
  View on WordPress.org
• SEOPress Theme · seopress
  Possible match Abandoned
  Before 6.5.0.3
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• Unknown SEOPress — Before 6.5.0.3
• seopress seopress — Before 6.5.0.3

References

• wpscan.com https://wpscan.com/vulnerability/fb8791f5-2879-431e-9afc-06d5839e4b9d Exploit, Third Party Advisory
• nvd.nist.gov Official NVD record