CVE-2018-6195 - admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter to wp-admin/upload.php

Back Back to CVE browser

HIGH

admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter to wp-admin/upload.php

Published Jan 30, 2018

7.2

HIGH

CVSS 3.1

EPSS 3.72%

Description

admin/partials/wp-splashing-admin-main.php in the Splashing Images plugin (wp-splashing-images) before 2.1.1 for WordPress allows authenticated (administrator, editor, or author) remote attackers to conduct PHP Object Injection attacks via crafted serialized data in the 'session' HTTP GET parameter to wp-admin/upload.php.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-1321

References (4)

http://packetstormsecurity.com/files/146109/WordPress-Splashing-Images-2.1-Cross-Site-Scripting-PHP-Object-Injection.html
x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2018/Jan/91
mailing-listx_refsource_FULLDISCExploitMailing ListThird Party Advisory
https://plugins.trac.wordpress.org/changeset/1807349/wp-splashing-images
x_refsource_CONFIRMPatchVendor Advisory
https://wpvulndb.com/vulnerabilities/9015
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
http://packetstormsecurity.com/files/146109/WordPress-Splashing-Images-2.1-Cross-Site-Scripting-PHP-Object-Injection.html		x_refsource_MISCExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2018/Jan/91		mailing-listx_refsource_FULLDISCExploitMailing ListThird Party Advisory
https://plugins.trac.wordpress.org/changeset/1807349/wp-splashing-images		x_refsource_CONFIRMPatchVendor Advisory
https://wpvulndb.com/vulnerabilities/9015		x_refsource_MISCThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Jan 30, 2018

Updated Aug 5, 2024

Reserved Jan 24, 2018

Link CVE-2018-6195

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2018-6195

Red Hat

Severity n/a

Public date n/a

Links CVE-2018-6195