Wordpress Team Members Gs Plugins
Monthly
PHP object injection in the GS Plugins WordPress Team Members plugin through version 2.8.2 lets an authenticated low-privilege user submit crafted serialized data to a plugin feature that invokes PHP unserialize(), enabling object injection that can lead to high confidentiality, integrity, and availability impact if a usable POP gadget chain exists. The issue is network-reachable, requires no user interaction, and is scored CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit identified at time of analysis and no CISA KEV active exploitation was reported.
PHP object injection in the GS Plugins WordPress Team Members plugin through version 2.8.2 lets an authenticated low-privilege user submit crafted serialized data to a plugin feature that invokes PHP unserialize(), enabling object injection that can lead to high confidentiality, integrity, and availability impact if a usable POP gadget chain exists. The issue is network-reachable, requires no user interaction, and is scored CVSS 3.1 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); no public exploit identified at time of analysis and no CISA KEV active exploitation was reported.