PickPlugins Post Grid and Gutenberg Blocks PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the PickPlugins Post Grid and Gutenberg Blocks plugin, affecting versions through 2.3.11. This vulnerability could lead to PHP object injection, which, if exploited, might allow a malicious actor to execute code injection, SQL injection, path traversal, denial-of-service, and more, provided a suitable property-oriented programming chain is available.

Impact

Exploitation of this vulnerability could result in PHP object injection, allowing for various attacks such as code injection, SQL injection, path traversal, and denial-of-service, depending on the presence of a proper object-oriented programming chain.

Remediation

Users of the PickPlugins Post Grid and Gutenberg Blocks plugin should update to version 2.3.12 or later. Patchstack users can enable auto-update for vulnerable plugins.