CVE-2022-3360

The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is present, leadint to remote code execution (RCE). To successfully exploit this vulnerability attackers must have knowledge of the site secrets, allowing them to generate a valid hash via the wp_hash() function.

Score
CVSS 3.1 8.1 High
Status
Modified - contact@wpscan.com
Published
2022-10-31
Last modified
2025-05-06
Weaknesses
CWE-502

Affected products

References

 
 
© AVABIS GmbH privacypolicy about