PGS Core WordPress Plugin Unauthenticated PHP Object Injection Vulnerability

A PHP Object Injection vulnerability has been identified in the PGS Core plugin for WordPress, affecting all versions through 5.8.0. The issue arises from the deserialization of untrusted input in the 'import_header' function, allowing unauthenticated attackers to inject PHP objects. While no known payload execution chain exists within the vulnerable software, the presence of such a chain through an additional plugin or theme could enable an attacker to delete arbitrary files, access sensitive data, or execute code.

Impact

Exploitation of this vulnerability could lead to unauthorized PHP object injection, with the potential for object injection payloads to be executed if a suitable payload execution chain is available.

Remediation

Users are advised to update the PGS Core WordPress plugin to version 5.9.0 or later.