NotFound ARPrice WordPress Plugin PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the NotFound ARPrice WordPress plugin, affecting versions through 4.1.3. This vulnerability could lead to various injection attacks, including code injection, SQL injection, and PHP object injection, depending on the presence of a suitable payload chain.

Impact

Exploitation of this vulnerability could allow for PHP object injection, which could be leveraged to execute code, inject SQL, traverse directories, cause a denial-of-service, and more, if a proper payload chain is established.

Remediation

Users of the ARPrice WordPress plugin should update to version 4.2 or later. Patchstack users can enable auto-updates for vulnerable plugins.