Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions , CVE-2023-26326

CVE, Research URL: CVE-2023-26326
Home page URL: Security reports for Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions
Application: Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions
Published on: Feb 24, 2023
Research Description: The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker could leverage this issue to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.
Affected versions: Min -, max 2.8.2.
Status: vulnerable

Post Form &#8211; Registration Form &#8211; Profile Form for User Profiles &#8211; Frontend Content Forms for User Submissions , CVE-2023-26326