ConveyThis WordPress Language Translation Widget PHP Object Injection Vulnerability

A deserialization vulnerability allowing PHP object injection has been identified in the ConveyThis Language Translate Widget for WordPress, affecting versions through 264. This vulnerability arises from the deserialization of untrusted data, which could potentially be exploited to execute arbitrary code, inject malicious SQL, traverse file paths, cause a denial-of-service, or more, if a suitable object injection chain is available.

Impact

Exploitation of this vulnerability could lead to PHP object injection, allowing for various attacks such as code execution, SQL injection, path traversal, or denial-of-service, depending on the presence of a proper object injection chain.