WordPress Plugin Vulnerabilities
Row Seats Core < 2.68 - Unauthenticated PHP Object Injection
Description
The plugin row-seats insecurely trusts serialized data submitted over HTTP requests. This opens up the site to a PHP object injection vulnerability potential exploit vector.
This vulnerability was patched in version 2.68, information is being released now as a disclosure period has expired.
Proof of Concept
Attack is exploitable over HTTP requests to sites with the row-seats Plugin.
Affects Plugins
Fixed in 2.68 References
Classification
Type
OBJECT INJECTION
OWASP top 10
CWE
Miscellaneous
Submitter
Robert R
Submitter website
Submitter twitter
Verified
No
WPVDB ID
Timeline
Publicly Published
2017-04-27 (about 7 years ago)
Added
2017-05-21 (about 6 years ago)
Last Updated
2019-11-01 (about 4 years ago)
WPScan 