What the vulnerability does
01Description
The Print Science Designer plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.3.152 via deserialization of untrusted input through the 'designer-saved-projects' cookie. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Explanation of Vulnerability in Simple Terms
02Summary
Print Science Designer versions up to 1.3.152 contain a deserialization vulnerability that allows attackers to execute arbitrary code by sending a specially crafted network request. No authentication or user interaction is required. The vulnerability affects confidentiality, integrity, and availability of the affected system.
What an attacker can do
03Attacker Capabilities
Run their own code on the server hosting Print Science Designer.
Potential impact on your site
04Site Impact
Complete compromise of the Print Science Designer installation and potentially the underlying server.
Conditions required to exploit
05Prerequisites
Network access to the application; no authentication required.
Key dates
06Disclosure timeline
December 12, 2024
CVE published
April 8, 2026
Record updated
