TagDiv Composer WordPress Plugin PHP Object Instantiation Vulnerability

A vulnerability allowing arbitrary PHP object instantiation has been identified in the TagDiv Composer plugin for WordPress, affecting all versions through 5.3. This vulnerability allows unauthenticated attackers to instantiate PHP objects via the module parameter. While no known payload chain exists within the vulnerable software itself, the impact could be significant if another plugin or theme containing a payload chain is installed on the same site. In such cases, the vulnerability could potentially be exploited to delete arbitrary files, access sensitive data, or execute code, depending on the nature of the payload chain.

Impact

Exploitation of this vulnerability could lead to unauthorized PHP object instantiation, with potential for further exploitation if a payload chain is available through another plugin or theme.

Remediation

Users are advised to update the TagDiv Composer plugin to version 5.4 or later.