Optiontree
Monthly
PHP Object Injection in the OptionTree WordPress plugin (versions <= 2.7.3) enables authenticated administrators to submit crafted serialized PHP data through the plugin's Editor interface, triggering dangerous deserialization that can culminate in arbitrary code execution on the host server. The CVSS vector (PR:H) confirms that exploitation is gated behind WordPress administrator credentials, constraining the immediate threat surface. No public exploit code or active exploitation has been identified at time of analysis.
The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
PHP Object Injection in the OptionTree WordPress plugin (versions <= 2.7.3) enables authenticated administrators to submit crafted serialized PHP data through the plugin's Editor interface, triggering dangerous deserialization that can culminate in arbitrary code execution on the host server. The CVSS vector (PR:H) confirms that exploitation is gated behind WordPress administrator credentials, constraining the immediate threat surface. No public exploit code or active exploitation has been identified at time of analysis.
The option-tree plugin before 2.7.3 for WordPress has Object Injection because serialized classes are mishandled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The option-tree plugin before 2.7.3 for WordPress has Object Injection because the + character is mishandled. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The option-tree plugin before 2.7.0 for WordPress has Object Injection by leveraging a valid nonce. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.