Vulnerability feed

Executive summary

A deserialization flaw in the Relevanssi WordPress plugin, versions through 4.28.4, lets attackers inject PHP objects. Patchstack rates it as medium priority with a CVSS severity of 7.2 and says it is expected to be exploited. The vendor-side recommendation is to update the plugin to version 4.28.5 or later.

Technical summary

The weakness is classified as PHP Object Injection, caused by deserialization of untrusted data, and the advisory says it allows object injection. The advisory states the required privilege is Editor, so an attacker needs an account with that role. Affected versions are listed as n/a through 4.28.4 by NVD and as 4.28.4 and earlier by Patchstack, and the patched version is 4.28.5. Patchstack has issued a mitigation rule that blocks attacks until the update is applied. The advisory does not state a workaround beyond the mitigation rule, and it does not give specific detection guidance or whether exploitation has been observed in the wild.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

High

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affects

Christoph VielgraderPatchstackChristoph Vielgrader RelevanssiPatchstack Relevanssi