CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Deserialization of Untrusted Data vulnerability in maximsecudeal Secudeal Payments for Ecommerce secudeal-payments-for-ecommerce allows Object Injection.This issue affects Secudeal Payments for Ecommerce: from n/a through <= 1.1.
Explanation of Vulnerability in Simple Terms
Secudeal Payments for Ecommerce versions 1.1 and earlier contain a deserialization vulnerability in payment processing. An attacker with low-level access can send malicious serialized data that the plugin deserializes without validation, leading to arbitrary code execution on the site. This affects confidentiality, integrity, and availability of the entire installation.
What an attacker can do
Run arbitrary code on the site with the privileges of the web server process.
Potential impact on your site
An authenticated attacker can compromise your entire site, steal data, modify content, or take the site offline.
Conditions required to exploit
Attacker must have low-level user account access (e.g., customer or subscriber role) and network access to the site.
Key dates
External resources
Related vulnerabilities
