Vulnerability feed

Executive summary

A deserialization flaw in the Paytium WordPress plugin, versions up to and including 5.0.5, lets unauthenticated attackers inject PHP objects. The advisory rates it critical at CVSS 9.8 and says it is expected to be exploited in mass campaigns. The vendor recommends updating the plugin to version 5.0.6 or later.

Technical summary

The flaw is a PHP Object Injection caused by deserialization of untrusted data, classified as OWASP A3: Injection. The advisory states the attack requires no privileges (unauthenticated) and gives a CVSS score of 9.8. Affected versions are stated as n/a through 5.0.5 and <= 5.0.5, with the patched version 5.0.6. The advisory says Patchstack has issued a mitigation rule that blocks attacks until the plugin is updated, but it does not describe a manual workaround, the specific vulnerable code path, or indicators of compromise and detection guidance. Whether exploitation in the wild has been observed is not stated beyond the expectation that it will be exploited.

Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source.

Summarized from patchstack.com/database/wordpress/plugi…nerability?_s_id=cve

Impact if exploited

How it is exploited

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

None

Scope

Unchanged

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affects

paytiumsupportPatchstackpaytiumsupport Paytium