ultrapressorg Empowerment Plugin up to 1.0.2 on WordPress deserialization

Summaryinfo

A vulnerability categorized as critical has been discovered in ultrapressorg Empowerment Plugin up to 1.0.2 on WordPress. The affected element is an unknown function. Executing a manipulation can lead to deserialization. The identification of this vulnerability is CVE-2024-7433. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in ultrapressorg Empowerment Plugin up to 1.0.2 on WordPress. It has been declared as critical. This vulnerability affects an unknown functionality. The manipulation with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

The Empowerment theme for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.2 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

The weakness was shared by Francesco Carlucci. The advisory is shared for download at wordfence.com. This vulnerability was named CVE-2024-7433 since 08/02/2024. The exploitation appears to be easy. The attack can be initiated remotely. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 10/02/2024).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• WordPress Plugin

Vendor

• ultrapressorg

Name

• Empowerment Plugin

Version

• 1.0.0
• 1.0.1
• 1.0.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion