CVE-2024-5488

CRITICALNuclei

SEOPress < 7.9 - Unauthenticated Object Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-5488 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jul 9, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

SEOPress

Default status: unaffected

CVE ListBefore 7.9affected

seopress

Browse seopress / seopress

Default status: unknown

CVE ListBefore 7.9affected

Nuclei templates

1
ProjectDiscoveryCRITICALSEOPress < 7.9 - Authentication BypassCVSS 9.8

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.

Impact

Unauthenticated attackers can bypass authentication protections and exploit object injection to unserialize malicious gadget chains, potentially achieving remote code execution if suitable chains are present.

Remediation

Update SEOPress plugin to version 7.9 or later to address the authentication bypass and object injection vulnerabilities.

Authorspdresearch, iamnoooob, rootxharsh
Template tagscvecve2024wpwordpresswp-pluginseopressauth-bypassvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
https://wpscan.com/blog/object-injection-vulnerability-fixed-in-seopress-7-9/ https://wpscan.com/vulnerability/28507376-ded0-4e1a-b2fc-2182895aa14c/ https://github.com/fkie-cad/nvd-json-data-feeds https://nvd.nist.gov/vuln/detail/CVE-2024-5488

Source: ProjectDiscovery

References

2