WordPress CVEs

Description

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.

Affected WordPress components

• SEOPress – AI SEO Plugin & On-site SEO Plugin · wp-seopress
  Confirmed match Active
  Before 7.9
  View on WordPress.org
• seopress Plugin · seopress
  Possible match Homeless
  Before 7.9
  View on WordPress.org
• SEOPress Theme · seopress
  Possible match Abandoned
  Before 7.9
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• Unknown SEOPress — Before 7.9
• seopress seopress — Before 7.9

References

• wpscan.com https://wpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c/ Exploit, Third Party Advisory
• nvd.nist.gov Official NVD record