WordPress WpEvently Plugin Deserialization of Untrusted Data Vulnerability

A deserialization of untrusted data vulnerability has been identified in the WordPress WpEvently plugin, specifically in versions through 5.0.8. This vulnerability allows object injection, which could be exploited to manipulate the application's logic, potentially leading to a denial-of-service condition or arbitrary code execution. In some cases, it could allow unauthorized access to the admin panel.

Impact

Exploitation of this vulnerability could disrupt website operations, cause a denial-of-service, or allow arbitrary code execution. Additionally, it could be used to gain unauthorized access to the WordPress admin panel.

Remediation

Users of the WpEvently plugin should update to version 5.0.9 or later. Patchstack users can enable auto-update for vulnerable plugins.