1. Home
  2. CVE Database
  3. CVE-2024-5488
CRITICAL · 9.8

CVE-2024-5488

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unser...

Vulnerability Description

The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unserialize malicious gadget chains, compromising the site if a suitable chain is present.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
SeopressSeopress< 7.9

Related Weaknesses (CWE)

CWE-502

References

FAQ

What is CVE-2024-5488?

CVE-2024-5488 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The SEOPress WordPress plugin before 7.9 does not properly protect some of its REST API routes, which combined with another Object Injection vulnerability can allow unauthenticated attackers to unser...

How severe is CVE-2024-5488?

CVE-2024-5488 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2024-5488?

Check the references section above for vendor advisories and patch information. Affected products include: Seopress Seopress.