Vk Google Job Posting Manager
Monthly
PHP object injection in the VK Google Job Posting Manager WordPress plugin (versions through 1.3.1) allows an authenticated low-privilege user to submit crafted serialized input that the plugin deserializes without validation, permitting object injection that can escalate to arbitrary code execution, file manipulation, or sensitive data exposure where a usable gadget chain exists in the plugin or its loaded libraries. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), the flaw is network-reachable with low complexity, requires only low-level authentication, and needs no user interaction, resulting in high confidentiality, integrity, and availability impact. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; reliability of full code execution depends on an unconfirmed PHP POP gadget chain, so successful exploitation is most plausible against sites where subscribers or other low-privilege accounts can be created or reached.
PHP object injection in the VK Google Job Posting Manager WordPress plugin (versions through 1.3.1) allows an authenticated low-privilege user to submit crafted serialized input that the plugin deserializes without validation, permitting object injection that can escalate to arbitrary code execution, file manipulation, or sensitive data exposure where a usable gadget chain exists in the plugin or its loaded libraries. Per the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), the flaw is network-reachable with low complexity, requires only low-level authentication, and needs no user interaction, resulting in high confidentiality, integrity, and availability impact. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; reliability of full code execution depends on an unconfirmed PHP POP gadget chain, so successful exploitation is most plausible against sites where subscribers or other low-privilege accounts can be created or reached.