BoldGrid weForms WordPress Plugin PHP Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the BoldGrid weForms WordPress plugin, affecting versions through 1.6.26. This vulnerability could lead to PHP object injection, which, if exploited, might allow a malicious actor to execute code, inject SQL, traverse paths, cause a denial of service, and more, provided a suitable object injection chain is available.

Impact

Exploitation of this vulnerability could result in PHP object injection, allowing for various attacks such as code execution, SQL injection, path traversal, and denial of service, depending on the presence of a proper object injection chain.

Remediation

Users of the BoldGrid weForms WordPress plugin should update to version 1.6.27 or later. Patchstack users can enable auto-update for vulnerable plugins.