CVE-2016-4825

The Collne Welcart e-Commerce plugin before 1.8.3 for WordPress allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted serialized data.

CVSS v3.1 NVD

5.6 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CVSS v2.0 NVD

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

2.86% chance of exploitation in the next 30 days, 87th percentile

Published

2016-06-25

Updated

2024-08-06

Proof-of-concept exploits (1)

• kaito834/cve-2016-4845_csrf0★ · 2016-08-21

Security advisories

• http://jvn.jp/en/jp/JVN47363774/index.html
• http://jvndb.jvn.jp/jvndb/JVNDB-2016-000115
• http://www.welcart.com/community/archives/78977

References

• CVE Record
• NVD entry

Related

• CVE-2016-4845