CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in kkarpieszuk WC Price History for Omnibus wc-price-history allows Object Injection.This issue affects WC Price History for Omnibus: from n/a through <= 2.1.4.
Explanation of Vulnerability in Simple Terms
WC Price History for Omnibus versions up to 2.1.4 contain a deserialization vulnerability that allows high-privileged users to execute arbitrary code on the site. An attacker with admin or equivalent access can craft malicious serialized data to trigger unintended PHP execution. This affects the plugin's data handling and requires administrative credentials to exploit.
What an attacker can do
Run arbitrary PHP code on the site with full site privileges.
Potential impact on your site
A compromised admin account can be used to take full control of your site, modify data, or install malware.
Conditions required to exploit
Attacker must have high-level admin or equivalent access to the WordPress site.
Key dates
External resources
Related vulnerabilities
