Pdfcrowd Save as PDF WordPress Plugin PHP Object Injection Vulnerability

A deserialization vulnerability allowing PHP object injection has been identified in the Save as PDF plugin by Pdfcrowd, affecting versions through 4.4.0. This vulnerability arises from the deserialization of untrusted data, which could potentially be exploited to inject objects into the application.

Impact

Exploitation of this vulnerability could lead to PHP object injection, allowing for various types of code injection, such as SQL injection, path traversal, or denial-of-service, especially if a suitable property-oriented programming chain is available.

Remediation

Users of the Save as PDF plugin by Pdfcrowd should update to version 4.4.1 or later. Patchstack users can enable auto-update for vulnerable plugins.