WordPress WP Ticket Customer Service Software & Support Ticket System PHP Object Injection Vulnerability

A deserialization vulnerability allowing PHP object injection has been identified in the WP Ticket Customer Service Software & Support Ticket System plugin for WordPress, affecting versions through 6.0.2. This vulnerability arises from the deserialization of untrusted data, which could potentially be exploited to inject malicious objects.

Impact

Exploitation of this vulnerability could lead to PHP object injection, allowing for various types of code injection, such as SQL injection, path traversal, or denial-of-service, depending on the presence of a suitable object injection chain.

Remediation

Users of the WP Ticket Customer Service Software & Support Ticket System plugin should update to version 6.0.3 or later. Patchstack users can enable auto-update for vulnerable plugins.