Metagauss EventPrime WordPress Plugin Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the Metagauss EventPrime WordPress plugin, specifically in versions through 4.2.8.0. This vulnerability arises from the improper handling of untrusted data, which could potentially be exploited to execute arbitrary code, inject malicious SQL, traverse file paths, cause a denial of service, and more, if a suitable object injection chain is available.

Impact

Exploitation of this vulnerability could lead to PHP object injection, allowing for a range of attacks including code execution, SQL injection, path traversal, and denial of service.

Remediation

Users of the Metagauss EventPrime WordPress plugin should update to version 4.2.8.1 or later. Patchstack users can enable auto-updates for vulnerable plugins.