Wp Spell Check
Monthly
PHP object injection in the WP Spell Check WordPress plugin, affecting all versions up to and including 12.1, allows an attacker who already holds administrator-level privileges to pass attacker-controlled data into PHP's deserialization routine and instantiate arbitrary objects. Successful object injection can lead to high-integrity and high-confidentiality impact - including code execution, file manipulation, or privilege abuse - depending on whether a usable POP gadget chain exists in the plugin or the surrounding WordPress environment, which the available data does not confirm. With a CVSS 3.1 base score of 7.2 (High) and PR:H in the vector, the practical attack surface is limited to trusted high-privilege users; no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
PHP object injection in the WP Spell Check WordPress plugin, affecting all versions up to and including 12.1, allows an attacker who already holds administrator-level privileges to pass attacker-controlled data into PHP's deserialization routine and instantiate arbitrary objects. Successful object injection can lead to high-integrity and high-confidentiality impact - including code execution, file manipulation, or privilege abuse - depending on whether a usable POP gadget chain exists in the plugin or the surrounding WordPress environment, which the available data does not confirm. With a CVSS 3.1 base score of 7.2 (High) and PR:H in the vector, the practical attack surface is limited to trusted high-privilege users; no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.