Magepeople WpEvently WordPress Plugin PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the WpEvently WordPress plugin by Magepeople. This issue affects versions through 4.3.6. The vulnerability arises from the improper handling of untrusted data, which could potentially be exploited to execute arbitrary code, inject malicious SQL, traverse directories in an unintended manner, or cause a denial-of-service condition, especially if a suitable property-oriented programming chain is available.

Impact

Exploitation of this vulnerability could lead to PHP object injection, allowing for various attacks such as code execution, SQL injection, path traversal, or denial-of-service, depending on the presence of a proper object injection chain.

Remediation

Users of the WpEvently WordPress plugin should update to version 4.3.7 or later. Patchstack users can enable auto-updates for vulnerable plugins.