WordPress Modal Popup Box PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the WordPress Modal Popup Box plugin, affecting versions through 1.6.1. This vulnerability could lead to various types of code injection, including SQL injection, path traversal, and denial-of-service, if exploited within a proper object injection chain.

Impact

Exploitation of this vulnerability could allow for PHP object injection, potentially leading to code execution, SQL injection, path traversal, denial-of-service, and other impacts, depending on the presence of a suitable object injection chain.

Remediation

Users of the WordPress Modal Popup Box plugin should update to version 1.6.2 or later. Patchstack users can enable auto-update for vulnerable plugins.