Wp Ultimate Exporter
Monthly
PHP object injection in the WordPress plugin WP Ultimate Exporter (Smackcoders Inc.) affects all versions up to and including 3.0, allowing an attacker who already holds a high-privilege authenticated account on the target site to submit crafted serialized PHP data to a plugin endpoint and instantiate arbitrary objects. Successful exploitation depends on a usable POP gadget chain being present in the plugin, WordPress core, or a loaded library; without one, the flaw may only yield object injection rather than full code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and the principal barrier is the CVSS PR:H prerequisite, which limits realistic abuse to privileged insiders or attackers who have already compromised an administrative account.
PHP object injection in the WordPress plugin WP Ultimate Exporter (Smackcoders Inc.) affects all versions up to and including 3.0, allowing an attacker who already holds a high-privilege authenticated account on the target site to submit crafted serialized PHP data to a plugin endpoint and instantiate arbitrary objects. Successful exploitation depends on a usable POP gadget chain being present in the plugin, WordPress core, or a loaded library; without one, the flaw may only yield object injection rather than full code execution. No public exploit code or confirmed active exploitation was identified at time of analysis, and the principal barrier is the CVSS PR:H prerequisite, which limits realistic abuse to privileged insiders or attackers who have already compromised an administrative account.