Threats tagged 'ghsa-635p-78xg-j6w3'

The Gravity Forms plugin for WordPress up to and including version 3.1.2 is vulnerable to PHP Object Injection via a Post Custom Field of input type List. This occurs because the plugin uses WordPress' unrestricted maybe_unserialize() instead of its own hardened version, allowing unauthenticated attackers to inject PHP objects into post meta. While the plugin itself lacks a gadget chain, other plugins or themes may provide one, potentially enabling remote code execution. Specifically, if the custom field maps to the protected _wp_page_template meta key, WordPress functions can be leveraged to achieve remote code execution on vulnerable hosts.