1. Home
  2. CVE Database
  3. CVE-2024-3591
MEDIUM · 6.5

CVE-2024-3591

The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when ...

Vulnerability Description

The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
InfinitumformGeo Controller< 8.6.5

Related Weaknesses (CWE)

CWE-502

References

FAQ

What is CVE-2024-3591?

CVE-2024-3591 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The Geo Controller WordPress plugin before 8.6.5 unserializes user input via some of its AJAX actions and REST API routes, which could allow unauthenticated users to perform PHP Object Injection when ...

How severe is CVE-2024-3591?

CVE-2024-3591 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-3591?

Check the references section above for vendor advisories and patch information. Affected products include: Infinitumform Geo Controller.