WordPress CVEs

Description

The WP Simple Galleries plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.34 via deserialization of untrusted input from the 'wpsimplegallery_gallery' post meta via 'wpsgallery' shortcode. This allows authenticated attackers, with contributor-level permissions and above, to inject a PHP Object. No POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Affected WordPress components

• wp-simple-galleries Plugin · wp-simple-galleries
  Confirmed match Homeless
  Up to and including 1.34
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• maca134 WP Simple Galleries — Up to and including 1.34
• maca134 wp_simple_galleries — Up to and including 1.34

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/wp-simple-galleries/tags/1.34/wp-simple-gallery.php#L250 Exploit
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/0dc8f7cf-d8be-4229-b823-3bd9bc9f6eda?source=cve Third Party Advisory
• nvd.nist.gov Official NVD record