Description
The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user import (intentionally or not) a malicious settings file and a suitable gadget chain is present on the blog.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | WPtouch | < 4.3.45 | 4.3.45 |
References
- https://wpscan.com/vulnerability/55772932-eebd-475b-b5df-e80fab288ee5 exploit vdb-entry technical-description