WordPress JS Archive List Plugin Object Injection Vulnerability

A deserialization vulnerability allowing object injection has been identified in the WordPress JS Archive List Plugin, specifically in versions through 6.1.7. This vulnerability arises from the deserialization of untrusted data, which could potentially be exploited to execute arbitrary code or other malicious actions, depending on the presence of a suitable object injection chain.

Impact

Exploitation of this vulnerability could lead to PHP object injection, allowing for a range of attacks such as code execution, SQL injection, path traversal, or denial-of-service, especially if a proper object injection chain is established.

Remediation

Users of the WordPress JS Archive List Plugin should update to version 6.2.0 or later. Patchstack users can enable auto-update for vulnerable plugins.