CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L
What the vulnerability does
Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress: from n/a through 4.3.2.
Explanation of Vulnerability in Simple Terms
ProfilePress versions up to 4.3.2 contain a deserialization vulnerability in how they process untrusted data. An authenticated administrator can craft malicious serialized input that causes the plugin to deserialize and execute arbitrary code. This affects confidentiality, integrity, and availability of the site. Update to a version newer than 4.3.2.
What an attacker can do
Execute arbitrary code on the site by submitting malicious serialized data.
Potential impact on your site
A compromised admin account can run arbitrary code, potentially leading to full site takeover.
Conditions required to exploit
Attacker must have administrator-level access to the WordPress site.
Key dates
External resources
Related vulnerabilities
