Luk6785

**Name of the Vulnerable Software and Affected Versions** Turnkey bbPress by WeaverTheme versions prior to 1.7.2 **Description** The plugin is susceptible to PHP Object Injection, a condition where untrusted data is passed to the `unserialize()` function, potentially allowing an attacker to manipulate application logic. The issue occurs within the `wvrbbp set to serialized values()` function, which is accessed via the `wvrbbp save restore()` settings-restore handler. The function processes the raw contents of a file uploaded by an administrator without proper validation. Authenticated attackers with administrator-level access or higher can exploit this to inject a PHP Object. While no POP chain (a sequence of gadgets used to achieve code execution) exists within the plugin itself, the presence of one in another installed plugin or theme could enable the deletion of arbitrary files, retrieval of sensitive data, or remote code execution. **Recommendations** Update the plugin to a version newer than 1.7.1. As a temporary mitigation, restrict the use of the `wvrbbp save restore()` settings-restore handler.

**Name of the Vulnerable Software and Affected Versions** Customizer Export/Import plugin for WordPress versions up to, and including, 0.9.7 **Description** The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ` import` function. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server, which may make remote code execution possible. The vulnerability is only exploitable when used in conjunction with a race condition as the uploaded file is deleted shortly after it is created. **Recommendations** For versions up to, and including, 0.9.7, consider disabling the ` import` function until a patch is available to prevent arbitrary file uploads. Restrict access to the plugin's import functionality to minimize the risk of exploitation. Avoid using the plugin for importing files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.