Go Live Update Urls
Monthly
PHP object injection in the WordPress plugin Go Live Update Urls (Mat Lipe) version 7.0.8 and earlier allows an authenticated attacker holding at least the Contributor role to pass crafted serialized data that the plugin deserializes, potentially leading to full confidentiality, integrity, and availability impact on the affected site if a usable PHP gadget chain is present in the plugin, WordPress core, or another installed theme/plugin. The vulnerability is network-reachable with low attack complexity, requires only low-privileged authentication (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) and no user interaction; exploitation additionally depends on the availability of a viable POP gadget chain, a common but not universal precondition. At the time of analysis there is no public exploit identified and no confirmation of active exploitation (not listed in CISA KEV), and no vendor-released fixed version is confirmed in the available data. Risk triage should treat this as a high-priority issue for any site running the vulnerable plugin where Contributor accounts are easily obtainable (for example, open self-registration).
PHP object injection in the WordPress plugin Go Live Update Urls (Mat Lipe) version 7.0.8 and earlier allows an authenticated attacker holding at least the Contributor role to pass crafted serialized data that the plugin deserializes, potentially leading to full confidentiality, integrity, and availability impact on the affected site if a usable PHP gadget chain is present in the plugin, WordPress core, or another installed theme/plugin. The vulnerability is network-reachable with low attack complexity, requires only low-privileged authentication (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8 High) and no user interaction; exploitation additionally depends on the availability of a viable POP gadget chain, a common but not universal precondition. At the time of analysis there is no public exploit identified and no confirmation of active exploitation (not listed in CISA KEV), and no vendor-released fixed version is confirmed in the available data. Risk triage should treat this as a high-priority issue for any site running the vulnerable plugin where Contributor accounts are easily obtainable (for example, open self-registration).