WP Job Manager <= 1.29.2 - PHP Object Injection
2018-03-02 00:00
AnonymousStrategic Overview
Vulnerability Overview
The WP Job Manager plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.29.2 via deserialization of untrusted input in the get_job_listings function. This allows unauthorized attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to implement their own payload and/or unserialize malicious input.
Technical Analysis
REMEDIATION: Update to version 1.29.3, or a newer patched version --- IDENTIFIER: CWE-502 (Deserialization of Untrusted Data) The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
External References
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C