CVE-2024-5488 - SEOPress < 7.9 - Unauthenticated Object Injection

Back Back to CVE browser

CRITICAL

SEOPress < 7.9 - Unauthenticated Object Injection

Published Jul 9, 2024

9.8

CRITICAL

CVSS 3.1

EPSS 3.74%

Description

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.

Affected products

Vendor n/a Product SEOPress Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <7.9

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

SEOPress

unaffected

Version	Status	Constraints
0	affected	<7.9

Vendor Seopress Product Seopress Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <7.9

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Seopress

n/a

Version	Status	Constraints
0	affected	<7.9

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-502

Deserialization of Untrusted Data

References (1)

https://wpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c/
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://wpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c/		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Jul 9, 2024

Updated Aug 1, 2024

Reserved May 29, 2024

Link CVE-2024-5488

CISA Vulnrichment

Updated Jul 9, 2024

NVD

Status Analyzed

Modified Jun 17, 2026

Link CVE-2024-5488

Red Hat

Severity n/a

Public date n/a

Links CVE-2024-5488