Designsetgo
Monthly
PHP object injection in the WordPress plugin DesignSetGo 2.8.0 and earlier allows an authenticated user with Contributor-level access to submit a crafted serialized payload, which the plugin then deserializes, potentially leading to data theft, file manipulation, or remote code execution depending on which PHP gadget chains are reachable in the site's loaded code. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) confirms remote, low-complexity exploitation requiring only a low-privileged authenticated account and no user interaction, and the impact is assessed as high across confidentiality, integrity, and availability - though the practical outcome depends on the presence of a usable gadget chain. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV (not confirmed actively exploited); no EPSS score was supplied, but the self-registerable nature of the Contributor role on many sites keeps the real-world risk elevated.
PHP object injection in the WordPress plugin DesignSetGo 2.8.0 and earlier allows an authenticated user with Contributor-level access to submit a crafted serialized payload, which the plugin then deserializes, potentially leading to data theft, file manipulation, or remote code execution depending on which PHP gadget chains are reachable in the site's loaded code. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) confirms remote, low-complexity exploitation requiring only a low-privileged authenticated account and no user interaction, and the impact is assessed as high across confidentiality, integrity, and availability - though the practical outcome depends on the presence of a usable gadget chain. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV (not confirmed actively exploited); no EPSS score was supplied, but the self-registerable nature of the Contributor role on many sites keeps the real-world risk elevated.