Rasoul Jahanshahi

**Name of the Vulnerable Software and Affected Versions** Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress versions up to, and including 3.3.3 **Description** The issue concerns deserialization of untrusted input via the `upload[file]` parameter. This allows authenticated administrative users to call files using a PHAR wrapper, which can deserialize and call arbitrary PHP Objects. These objects can be used to perform malicious actions if a POP chain is also present. **Recommendations** For versions up to, and including 3.3.3, update to a version higher than 3.3.3 to resolve the issue. As a temporary workaround, consider restricting access to the `upload[file]` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** WP Editor plugin for WordPress versions up to, and including 1.2.9 **Description** The issue allows deserialization of untrusted input via the `current theme root` parameter. This enables authenticated attackers with administrative privileges to call files using a PHAR wrapper, which can deserialize and call arbitrary PHP Objects. These objects can be used to perform malicious actions if a POP chain is also present. The attack requires the attacker to successfully upload a file with the serialized payload. **Recommendations** For versions up to, and including 1.2.9, consider disabling the `current theme root` parameter until a patch is available to prevent deserialization of untrusted input. Restrict access to file uploads to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Theme Editor plugin for WordPress versions up to, and including 2.8 **Description** The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the `images array` parameter. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects, which can be used to perform a variety of malicious actions if a POP chain is also present. The attack requires the attacker to be successful in uploading a file with the serialized payload. **Recommendations** For versions up to, and including 2.8, consider disabling the `images array` parameter until a patch is available to prevent deserialization of untrusted input. Restrict access to the plugin's functionality to minimize the risk of exploitation. Avoid using the `images array` parameter in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ImageMagick Engine plugin for WordPress versions up to, and including 1.7.5 **Description** The issue allows for remote code execution via the `cli path` parameter. This enables unauthenticated users to run arbitrary commands, potentially leading to remote command execution if a site administrator can be tricked into performing a specific action, such as clicking on a link. As a result, attackers can create or modify files on the server, which may grant them backdoor access to the affected server. **Recommendations** For versions up to, and including 1.7.5, consider disabling the `cli path` parameter until a patch is available to prevent remote code execution. Restrict access to the plugin's functionality to minimize the risk of exploitation. Avoid using the `cli path` parameter in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ImageMagick Engine plugin for WordPress versions up to, and including 1.7.5 **Description** The issue allows deserialization of untrusted input via the `cli path` parameter. This enables unauthenticated users to call files using a PHAR wrapper if they can trick a site administrator into performing a specific action, such as clicking on a link, which deserializes and calls arbitrary PHP Objects. This can be used for malicious actions if a POP chain is also present, and the attacker successfully uploads a file with the serialized payload. **Recommendations** For versions up to, and including 1.7.5, consider disabling the `cli path` parameter until a patch is available to prevent deserialization of untrusted input. Restrict access to the plugin's functionality to minimize the risk of exploitation. Avoid using the `cli path` parameter in the affected plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WordPress Infinite Scroll – Ajax Load More plugin versions up to, and including 5.5.3 **Description** The issue allows deserialization of untrusted input via the `alm repeaters export` parameter. This enables unauthenticated users to potentially call files using a PHAR wrapper if they can trick a site administrator into performing a specific action, such as clicking on a link. The action must deserialize and call arbitrary PHP Objects, which can be used for malicious purposes if a POP chain is present. Additionally, the attacker must successfully upload a file containing the serialized payload. **Recommendations** For WordPress Infinite Scroll – Ajax Load More plugin versions up to, and including 5.5.3, consider disabling the `alm repeaters export` parameter until a patch is available to prevent deserialization of untrusted input. Restrict access to the plugin's functionality to minimize the risk of exploitation, especially in scenarios where an attacker could trick an administrator into performing actions that lead to deserialization of malicious payloads.

**Name of the Vulnerable Software and Affected Versions** String Locator plugin for WordPress versions up to, and including 2.5.0 **Description** The issue allows deserialization of untrusted input via the `string-locator-path` parameter. This enables unauthenticated users to call files using a PHAR wrapper if they can trick a site administrator into performing a specific action, such as clicking on a link, which deserializes and calls arbitrary PHP Objects. This can lead to various malicious actions if a POP chain is also present, and the attacker successfully uploads a file with the serialized payload. **Recommendations** For String Locator plugin for WordPress versions up to, and including 2.5.0, update to a version higher than 2.5.0 to resolve the issue. As a temporary workaround, consider restricting access to the `string-locator-path` parameter to minimize the risk of exploitation. Avoid using the `string-locator-path` parameter in the affected plugin until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Download Manager plugin for WordPress versions up to and including 3.2.49 **Description** The issue allows authenticated attackers with contributor privileges and above to deserialize untrusted input via the `file[package dir]` parameter. This can lead to the execution of arbitrary PHP objects, enabling various malicious actions if a POP chain is present. The attack requires the successful upload of a file containing a serialized payload. **Recommendations** For Download Manager plugin for WordPress versions up to and including 3.2.49, update to a version that contains a fix for this issue. As a temporary workaround, consider restricting access to the `file[package dir]` parameter to minimize the risk of exploitation. Avoid using the `file[package dir]` parameter in the affected plugin until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Broken Link Checker plugin for WordPress versions up to, and including 1.11.16 **Description** The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the `$log file` value. This allows authenticated attackers with administrative privileges and above to call files using a PHAR wrapper, which can deserialize the data and call arbitrary PHP Objects. These objects can be used to perform malicious actions if a POP chain is also present. The attack requires the attacker to successfully upload a file with the serialized payload. **Recommendations** For versions up to, and including 1.11.16, update to a version that contains a fix for this issue to prevent deserialization of untrusted input. As a temporary workaround, consider restricting access to the `$log file` value to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Migration, Backup, Staging – WPvivid plugin for WordPress versions up to, and including 0.9.74 **Description** The issue allows deserialization of untrusted input via the `path` parameter. This enables authenticated attackers with administrative privileges to call files using a PHAR wrapper, which can deserialize and call arbitrary PHP Objects. These objects can be used to perform malicious actions if a POP chain is also present. The attack requires the attacker to successfully upload a file with the serialized payload. **Recommendations** For versions up to, and including 0.9.74, update to a version higher than 0.9.74 to resolve the issue. As a temporary workaround, consider restricting access to the `path` parameter to minimize the risk of exploitation. Additionally, restrict the ability to upload files with serialized payloads to prevent malicious actions.

**Name of the Vulnerable Software and Affected Versions** The Visualizer: Tables and Charts Manager for WordPress versions up to, and including 3.7.9 **Description** The issue concerns deserialization of untrusted input via the `remote data` parameter. This allows authenticated attackers with contributor privileges and above to call files using a PHAR wrapper, which can deserialize the data and call arbitrary PHP Objects. These objects can be used to perform various malicious actions if a POP chain is also present. The attack requires the successful upload of a file with a serialized payload. **Recommendations** For versions up to, and including 3.7.9, update to a version higher than 3.7.9 to mitigate the risk. As a temporary workaround, consider restricting access to the `remote data` parameter until a patch is available. Avoid using the `remote data` parameter in the affected plugin until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress versions up to, and including 2.9.8.5 **Description** The issue allows deserialization of untrusted input via the `fts url` parameter. This enables unauthenticated attackers to call files using a PHAR wrapper, which can deserialize the data and call arbitrary PHP Objects to perform malicious actions, provided a POP chain is also present. The attack requires the successful upload of a file with a serialized payload. **Recommendations** For Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress versions up to, and including 2.9.8.5, update to a version higher than 2.9.8.5 to resolve the issue. As a temporary workaround, consider restricting access to the `fts url` parameter to minimize the risk of exploitation.