CVE-2024-5488

SEOPress < 7.9 - Unauthenticated Object Injection

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.

Affected

SEOPress

CVSS v3.1 CNA

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

3.74% chance of exploitation in the next 30 days, 90th percentile

Nuclei

critical

Published

2024-07-09

Updated

2024-08-01

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c/

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-5488.yaml

Security advisories

• https://wpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c

References

• CVE Record
• NVD entry