NooTheme Visionary Core PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the NooTheme Visionary Core WordPress plugin, affecting versions through 1.4.9. This vulnerability could lead to various impacts, including code execution, SQL injection, path traversal, and denial of service, if exploited within a proper PHP object injection chain.

Impact

Exploitation of this vulnerability could allow for PHP object injection, which could be leveraged to execute arbitrary code, inject malicious SQL, traverse file paths inappropriately, cause a denial of service, or other impacts, depending on the presence of a suitable object injection payload chain.

Remediation

Users of the NooTheme Visionary Core WordPress plugin should update to version 1.5.0 or later. Patchstack users can enable auto-updates for vulnerable plugins.