Threats Tagged 'ghsa-3h53-mhw6-2896'

The ConvertPlus WordPress plugin up to version 3.6.3 contains a vulnerability involving deserialization of untrusted data via an AJAX action parameter. This flaw allows authenticated users with Subscriber-level access or higher to inject a PHP object if a gadget chain is available in other installed plugins or themes. The vulnerability arises from insufficient nonce validation, lack of capability checks, and improper sanitization that permits shortcode injection leading to unsafe unserialization. Exploitation depends on the presence of a POP chain in additional installed components. The vulnerability has a high severity rating with a CVSS score of 8.8.