New WordPress vulnerability discovered
Due to incorrect input sanitization, a PHP Object injection vulnerability that allowed base64 encoded user input was addressed by a WordPress anti-spam plugin with over 60,000 installations.
The plugin's goal is to eliminate spam from sign-up forms, comments, and other areas. Spam bots can be stopped, and users can input IP addresses to prohibit them.
Any WordPress plugin or form that accepts user input is necessary to only allow the inputs that are intended, such as text, photos, and email addresses.
Filtering out unexpected inputs is necessary. Sanitization is the term for the filtering procedure that keeps undesirable inputs out.
The vulnerability is published on the WPScan website:
| "The plugin passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain..." |