Modal Survey <= 2.0.1.8 - PHP Object Injection
2021-01-08 00:00
PagelyStrategic Overview
StatusPatched in 2.0.1.8.2
Affected PluginModal Survey - WordPress Poll, Survey & Quiz Plugin
Affected Version
<= 2.0.1.8CVSS9.1Critical
CVE
N/AVulnerability Overview
The Modal Survey plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.1.8 via deserialization of untrusted input using the unserialize() function. This allows authenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to remotely trigger commands and read, updated, and/or delete files.
Technical Analysis
REMEDIATION: Update to version 2.0.1.8.2, or a newer patched version --- IDENTIFIER: CWE-502 (Deserialization of Untrusted Data) The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C