Dynamic QR Code – generator: PHP Object Injection in WordPress plugin
The WordPress plugin Dynamic QR Code – generator by sosidee, versions up to and including 1.0.1, contains a PHP Object Injection vulnerability (CWE-502). An attacker with a Contributor-level account can submit crafted serialized data that the plugin processes, which may allow manipulation of server-side objects. Depending on the other installed plugins and themes, this can lead to code execution, data access or denial of service. The CNA Patchstack rates it CVSS 8.8, and no fixed version has been confirmed.
sosidee · Dynamic QR Code – generator
