CVE-2024-7560
News Flash <= 1.1.0 - Authenticated (Editor+) PHP Object Injection
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The News Flash theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.1.0 via deserialization of untrusted input from the newsflash_post_meta meta value. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
El tema News Flash para WordPress es vulnerable a la inyección de objetos PHP en todas las versiones hasta la 1.1.0 incluida a través de la deserialización de entradas no confiables del metavalor newsflash_post_meta. Esto hace posible que atacantes autenticados, con acceso a nivel de editor y superior, inyecten un objeto PHP. No hay ninguna cadena POP conocida presente en el software vulnerable. Si hay una cadena POP presente a través de un complemento o tema adicional instalado en el sistema de destino, podría permitir al atacante eliminar archivos arbitrarios, recuperar datos confidenciales o ejecutar código.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2024-08-06 CVE Reserved
- 2024-08-07 CVE Published
- 2024-08-08 CVE Updated
- 2024-08-13 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-502: Deserialization of Untrusted Data
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
https://themes.trac.wordpress.org/browser/news-flash/1.1.0/page.php#L8 | ||
https://www.wordfence.com/threat-intel/vulnerabilities/id/d5631826-6975-41e9-a896-f2aa0581334f?source=cve |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Codename065 Search vendor "Codename065" | News Flash Search vendor "Codename065" for product "News Flash" | <= 1.1.0 Search vendor "Codename065" for product "News Flash" and version " <= 1.1.0" | en |
Affected
|