Vulnerability Description
The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker could leverage this issue to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Themekraft | Buddyforms | < 2.7.8 |
Related Weaknesses (CWE)
References
- https://www.tenable.com/security/research/tra-2023-7ExploitThird Party Advisory
- https://www.tenable.com/security/research/tra-2023-7ExploitThird Party Advisory
FAQ
What is CVE-2023-26326?
CVE-2023-26326 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The BuddyForms WordPress plugin, in versions prior to 2.7.8, was affected by an unauthenticated insecure deserialization issue. An unauthenticated attacker could leverage this issue to call files usin...
How severe is CVE-2023-26326?
CVE-2023-26326 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2023-26326?
Check the references section above for vendor advisories and patch information. Affected products include: Themekraft Buddyforms.