CVE-2024-5488

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - contact@wpscan.com

Published

2024-07-09

Last modified

2024-08-01

Weaknesses

CWE-502

Affected products

• Seopress (Seopress)
• Seopress (Unknown)

References

• https://wpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c/