CVE-2022-45083 - WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection

Back Back to CVE browser

HIGH

WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection

Published Jan 19, 2024

7.2

HIGH

CVSS 3.1

EPSS 0.58%

Description

Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: from n/a through 4.3.2.

Affected products

Vendor ProfilePress Membership Team Product n/a Default
unaffected
- Version
  -
  Status
  affected
  Constraints
  <=4.3.2

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

ProfilePress Membership Team

n/a

unaffected

Version	Status	Constraints
-	affected	<=4.3.2

Remediation

Vendor solution

Update to 4.4.0 or a higher version.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (1)

https://patchstack.com/database/vulnerability/wp-user-avatar/wordpress-profilepress-plugin-4-3-2-auth-php-object-injection-vulnerability?_s_id=cve
vdb-entryThird Party Advisory

Link	Providers	Tags
https://patchstack.com/database/vulnerability/wp-user-avatar/wordpress-profilepress-plugin-4-3-2-auth-php-object-injection-vulnerability?_s_id=cve		vdb-entryThird Party Advisory