NotFound ARPrice WordPress Plugin Unauthenticated PHP Object Injection Vulnerability

A deserialization vulnerability allowing PHP object injection has been identified in the NotFound ARPrice WordPress plugin, affecting versions through 4.1.3. This vulnerability arises from the deserialization of untrusted data, which could potentially lead to various types of code injection, including SQL injection, path traversal, and denial-of-service, if a suitable object injection chain is exploited.

Impact

Exploitation of this vulnerability could allow for PHP object injection, which is a type of vulnerability where an attacker can manipulate the deserialization process of PHP objects. This could lead to arbitrary code execution, SQL injection, path traversal, denial-of-service, or other impacts, depending on the specific object injection chain that is exploited.

Remediation

Users of the NotFound ARPrice WordPress plugin should update to version 4.2 or later. Patchstack users can enable auto-updates for vulnerable plugins.