WP-CRM System PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the WP-CRM System WordPress plugin, affecting versions through 3.4.1. This vulnerability could lead to various injection attacks, including code injection, SQL injection, and path traversal, especially if a suitable property-oriented programming chain is available.

Impact

Exploitation of this vulnerability could allow for PHP object injection, with potential consequences such as code execution, SQL injection, path traversal, or denial-of-service, depending on the presence of a proper object injection chain.