Super Video Player
Monthly
PHP object injection in the bPlugins Super Video Player WordPress plugin affects all versions through 1.8.13, allowing an authenticated high-privilege user to submit untrusted serialized data that the plugin passes to PHP's deserialization routines. Because the CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2), the weakness is network-reachable and low-complexity but gated behind an administrator-level session in the affected WordPress installation, so anonymous and low-privilege visitors cannot reach the vulnerable path; no public exploit identified at time of analysis, and practical impact depends on the presence of a usable POP gadget chain in WordPress core, the plugin itself, or other installed components.
PHP object injection in the bPlugins Super Video Player WordPress plugin affects all versions through 1.8.13, allowing an authenticated high-privilege user to submit untrusted serialized data that the plugin passes to PHP's deserialization routines. Because the CVSS 3.1 vector is AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2), the weakness is network-reachable and low-complexity but gated behind an administrator-level session in the affected WordPress installation, so anonymous and low-privilege visitors cannot reach the vulnerable path; no public exploit identified at time of analysis, and practical impact depends on the presence of a usable POP gadget chain in WordPress core, the plugin itself, or other installed components.