CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in Al Imran Akash Recently recently-viewed-most-viewed-and-sold-products-for-woocommerce allows Object Injection.This issue affects Recently: from n/a through <= 1.1.
Explanation of Vulnerability in Simple Terms
The Recently plugin for WordPress contains a deserialization vulnerability in versions up to 1.1. An attacker can send a specially crafted request to deserialize untrusted data, leading to remote code execution on the affected site. No authentication or user interaction is required. Sites running version 1.1 or earlier are at immediate risk.
What an attacker can do
Run arbitrary PHP code on the site and take full control of it.
Potential impact on your site
Complete site compromise, data theft, malware injection, and loss of availability.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
