TotalSuite TotalContest Lite PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the TotalSuite TotalContest Lite WordPress plugin, affecting versions through 2.9.1. This vulnerability arises from the improper handling of untrusted data, which could lead to PHP object injection.

Impact

Exploitation of this vulnerability could allow a malicious actor to inject objects that, if manipulated correctly, could be used to execute arbitrary code, perform SQL injection, traverse directories in an unauthorized manner, cause a denial-of-service, or exploit other vulnerabilities that rely on a crafted object payload.

Remediation

Users are advised to update the TotalContest Lite plugin to the latest version. If an update is not possible, consult with your hosting provider or web developer for assistance.