Social Snap WordPress plugin: PHP Object Injection via Contributor account
The Social Snap WordPress plugin up to and including version 1.5.4 contains a PHP Object Injection vulnerability (CWE-502) that is rated 8.8 (High) by the CNA Patchstack. An authenticated attacker with a Contributor-level account can submit crafted serialized data, which may allow manipulation of server-side processing and, depending on the available gadget chains, further compromise of the website. The exact vulnerable input is not specified in the sources reviewed.
Socialsnap · Social Snap
