CVE-2026-103693: CVE-2026-103693: güvenilmeyen verinin serileştirmeden çıkarılması

Açıklama (NVD)

The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user from storing a serialized PHP object in user metadata that is deserialized when a public profile is viewed, allowing PHP object injection that can lead to arbitrary file write and potential remote code execution.

Özet bilgiler

CVSS v3.1

9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

%0,47 (yüzdelik 41)

CWE

CWE-502

Yama

Yok / bilinmiyor

Kaynaklar

• NVD kaydı
• wpscan.com
• CWE-502