What the vulnerability does
01Description
The Image Hotspot by DevVN plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.2.5 via deserialization of untrusted input in the 'devvn_ihotspot_shortcode_func' function. This makes it possible for authenticated attackers, with Author-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
Explanation of Vulnerability in Simple Terms
02Summary
Image Hotspot by DevVN versions 1.2.5 and earlier contain a code injection vulnerability. An authenticated user with low privileges can inject and execute arbitrary PHP code on the site. This allows complete compromise of the site's data and functionality. Update to a version newer than 1.2.5 immediately.
What an attacker can do
03Attacker Capabilities
Run arbitrary PHP code on the site with full access to data and files.
Potential impact on your site
04Site Impact
Complete site compromise: attackers can steal data, modify content, create admin accounts, or take the site offline.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
August 24, 2024
CVE published
April 8, 2026
Record updated
