A WP Life Image Gallery PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the A WP Life Image Gallery plugin, specifically in versions through 1.6.0. This vulnerability could lead to various injection attacks, including code injection, SQL injection, and path traversal, among others, if a suitable property-oriented programming chain is available.

Impact

Exploitation of this vulnerability could allow a malicious actor to inject objects, potentially leading to arbitrary code execution, SQL injection, path traversal, or a denial-of-service condition, depending on the presence of a proper property-oriented programming chain.

Remediation

Users are advised to update to a version later than 1.6.0. For those using Patchstack, a mitigation rule has been issued to block attacks until an official patch is available.