by Kastro
Paper/Archive/CVE-2024-5488

CVE-2024-5488

Unknown SEOPress — SEOPress < 7.9 - Unauthenticated Object Injection

EPSS 4%CVSS 9.8
critical.is priorityof 100
47
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 89.9.899 × 2018.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.

Affected

ProductAffectedFixed inSource
SEOPress< 7.97.9CNA
seopress< 7.97.9CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c