Gs Pins For Pinterest
Monthly
PHP object injection in GS Pins for Pinterest 1.9.2 and earlier allows an authenticated low-privilege WordPress user to pass crafted serialized data into PHP unserialize(), potentially enabling object injection and, if a usable POP gadget chain exists, code execution or other high-impact actions. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit was identified at time of analysis. Sites running the plugin should treat low-privilege accounts as an attack prerequisite and remove or mitigate the plugin until a fix is confirmed.
PHP object injection in GS Pins for Pinterest 1.9.2 and earlier allows an authenticated low-privilege WordPress user to pass crafted serialized data into PHP unserialize(), potentially enabling object injection and, if a usable POP gadget chain exists, code execution or other high-impact actions. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), and no public exploit was identified at time of analysis. Sites running the plugin should treat low-privilege accounts as an attack prerequisite and remove or mitigate the plugin until a fix is confirmed.