Ananda Dhakal

Deserialization of Untrusted Data vulnerability in Acowebs PDF Invoices and Packing Slips For WooCommerce pdf-invoices-and-packing-slips-for-woocommerce allows Object Injection.This issue affects PDF Invoices and Packing Slips For WooCommerce: from n/a through 1.4.10.

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Automattic WooCommerce woocommerce allows Leveraging Race Conditions.This issue affects WooCommerce: from 11.0.0 through 11.2.2.

Shop manager is subject to PHP Object Injection, a condition where untrusted input is passed to the PHP `unserialize()` function, potentially allowing an attacker to manipulate objects and execute arbitrary code.

This issue involves PHP Object Injection caused by the deserialization of untrusted input. Authenticated attackers with contributor-level access or higher can inject a PHP Object. While no POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) is present in the software itself, the presence of a POP chain via another installed plugin or theme could allow an attacker to execute code, retrieve sensitive data, or delete arbitrary files.

An unauthenticated attacker can perform a PHP Object Injection by sending crafted input to the lead plugin. This occurs when the application unserializes untrusted data, which can lead to the alteration of site data. PHP Object Injection is a vulnerability where an attacker can manipulate serialized objects to execute arbitrary code or modify application logic.

This issue involves PHP Object Injection caused by the deserialization of untrusted input. Authenticated attackers with contributor-level access or higher can inject a PHP Object. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain via other installed plugins or themes could allow an attacker to execute code, retrieve sensitive data, or delete arbitrary files.

The plugin is susceptible to PHP Object Injection, a condition where an application deserializes untrusted input, potentially allowing an attacker to manipulate the application logic. Authenticated users with contributor-level access or higher can inject a PHP Object. While no native POP chain (a sequence of gadgets used to achieve code execution) exists within the software, the presence of a POP chain in other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

The software is susceptible to PHP Object Injection, a condition where untrusted input is deserialized, allowing authenticated users with author-level access or higher to inject a PHP Object. While no internal POP chain (a sequence of gadgets used to execute malicious code during deserialization) is present in the software itself, the presence of a POP chain in other installed plugins or themes could enable an attacker to execute code, retrieve sensitive data, or delete arbitrary files.

This issue involves PHP Object Injection caused by the deserialization of untrusted input. Authenticated attackers with subscriber-level access or higher can inject a PHP Object. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain via another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

Authenticated attackers with contributor-level access and above can perform PHP Object Injection due to the deserialization of untrusted input. While no POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) is present in the software itself, the presence of a POP chain in another installed plugin or theme could allow the attacker to execute code, retrieve sensitive data, or delete arbitrary files.

An Insecure Direct Object Reference (IDOR) exists due to missing validation on a user controlled key. This allows authenticated attackers with subscriber-level access and above to perform unauthorized actions.

The WPCargo Track & Trace plugin for WordPress allows authenticated attackers with author-level access and above to perform PHP Object Injection. This occurs due to the deserialization of untrusted input, which is the process of converting a stored string back into a PHP object. While no native POP chain (a sequence of gadgets used to execute malicious code) exists within the software, the presence of a POP chain in another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

The plugin is susceptible to PHP Object Injection, a condition where an application deserializes untrusted input, potentially allowing an attacker to manipulate the application logic. Authenticated users with contributor-level access or higher can inject a PHP Object. While no native POP chain (a sequence of gadgets used to achieve code execution) exists within the plugin, the presence of a POP chain in other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

An issue exists due to the deserialization of untrusted input, allowing authenticated attackers with editor-level access and above to inject a PHP Object. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of one via another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

The FV Flowplayer Video Player plugin for WordPress is subject to PHP Object Injection due to the deserialization of untrusted input. This allows authenticated attackers with shop manager-level access or higher to inject a PHP Object. While no internal POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) is present in the software, the presence of a POP chain in other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

The 10Web Social plugin for WordPress allows authenticated attackers with contributor-level access and above to perform PHP Object Injection. This occurs due to the deserialization of untrusted input, which is the process of converting a stored string back into a PHP object. While no native POP chain (a sequence of gadgets used to execute malicious code) exists within the software, the presence of a POP chain in other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

The myPOS Checkout plugin for WordPress allows authenticated attackers with shop manager-level access or higher to perform PHP Object Injection. This occurs due to the deserialization of untrusted input, which is the process of converting a stored string back into a PHP object. While no native POP chain (a sequence of gadgets used to execute malicious code) exists within the plugin, the presence of a POP chain in other installed plugins or themes could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

This issue involves PHP Object Injection caused by the deserialization of untrusted input. Authenticated attackers with contributor-level access or higher can inject a PHP Object. While no POP chain (a sequence of gadgets used to achieve code execution) is present in the software itself, the presence of a POP chain via another installed plugin or theme could allow an attacker to execute code, retrieve sensitive data, or delete arbitrary files.

The Finale Lite – Sales Countdown Timer & Discount for WooCommerce plugin for WordPress allows authenticated attackers with shop manager-level access and above to perform PHP Object Injection. This occurs due to the deserialization of untrusted input, which is the process of converting a stored string back into a PHP object. While no POP chain (a sequence of gadgets used to execute malicious code) is present in the software itself, the presence of one in another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.

This issue involves PHP Object Injection caused by the deserialization of untrusted input. Authenticated attackers with shop manager-level access or higher can inject a PHP Object. While no POP chain (a sequence of gadgets used to execute arbitrary code during deserialization) is present in the software itself, the presence of a POP chain via another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution.