Truelayer Magento 2 Plugin
Monthly
Insecure deserialization in the TrueLayer Magento 2 Plugin's Psr16CacheAdapter component allows an attacker who already has write access to the Magento cache backend (Redis or Memcached) to achieve arbitrary code execution via crafted PHP objects. The flaw arises from PHP's unserialize() being called without class restrictions, and exploitation requires both cache-write capability-obtainable through local filesystem access or an exposed cache service-and the presence of a usable gadget chain in the deployed Magento/Adobe Commerce environment. Although rated CVSS 7.5, real-world risk is materially lower because the attack preconditions are stringent; no public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited.
Insecure deserialization in the TrueLayer Magento 2 Plugin's Psr16CacheAdapter component allows an attacker who already has write access to the Magento cache backend (Redis or Memcached) to achieve arbitrary code execution via crafted PHP objects. The flaw arises from PHP's unserialize() being called without class restrictions, and exploitation requires both cache-write capability-obtainable through local filesystem access or an exposed cache service-and the presence of a usable gadget chain in the deployed Magento/Adobe Commerce environment. Although rated CVSS 7.5, real-world risk is materially lower because the attack preconditions are stringent; no public exploit code has been identified at time of analysis, and the issue is not confirmed as actively exploited.